Certificates with logotypes

A lot of the early documentation on InfoCard focused attention on certificates with logotypes (RFC 3709). The idea here is to move toward a more visual way for humans to recognize certificates. The InfoCard identity selector relies on these logos to help the user decide whether she wants to share identity details with a relying party.

VeriSign has been issuing certificates with their own embedded logo for awhile now. As an example, if you visit https://www.etrade.com and look at its certificate, you'll find a cert extension with an OID of 1.3.6.1.5.5.7.1.12, which is a logotype extension. In this extension, you'll see a mime type such as "image/gif", followed by some binary data, which is the hash of the image, followed by an URL pointing to the image on the web. The identity selector downloads the image, hashes it, checks that the computed hash matches the hash in the cert extension, and then displays the logo to the user.

Here's the rub. While VeriSign is happy to put its own logo in the certificate (the issuer logo), it's not quite as thrilled about putting subject logos in that extension, because the work that would go into verifying those logos can't all be automated, and requires further human intervention. (Consider due diligence such as making sure one guy isn't trying to spoof another guy's logo by making one that looked a lot like it.)

One of the guys in the class made contact with the SSL engineering team at VeriSign and confirmed that indeed subject logotypes aren't on their roadmap, which doesn't bode well for the use of subject logos in the identity selector. I've also heard rumors inside Microsoft that the use of logos may need to be postponed. I wonder if this feature will just be dropped? That would be unfortunate.