V.  Accreditation - The Right Combination
D.  PKI Standards:  The Columns - Different Objectives 

When it comes to constructing Certificate Policies (CPs), one size does not fit all.  The list of legal and technical issues to be addressed in connection with the assessment of CAs and PKIs can be thought of us as the rows in an imaginary grid.  The universe of potential variations in business application can be thought of as the columns in the grid.  The ABA Information Security Committee's PKI Evaluation Guidelines uses such an imaginary grid to analyze and harmonize CAs and PKIs for purposes of inoperability. 

  Spring 1998 - Merrill, Charles R. <McCarter & English LLP, cmerrill@concentric.net>, "The Accreditation Guidelines: A Progress Report on a Work in Process of the ABA Information Security Committee,"  38 Jurimetrics 345 (ABA Section of Science & Technology Spring 1998)

  Spring 1998 - Greenwood, Daniel J. <Commonwealth of Mass, dan@civics.com>, "Risk and Trust Management Techniques for an 'Open But Bounded' Public Key Infrastructure'", 38 Jurimetrics 277 (ABA Section of Science & Technology Spring 1998)

Jan 98 - "Delta Certificate Policies to Fulfill Specific Application Requirements -- or how to eliminate the proliferation of distinct certificate policies,"  an elegant paper by veteran PKI consultant J.F. Sauriol of Labcal Technologies, Inc. in Quebec,simple enough to be understood by a PKI novice, explaining how certificate policies can be designed by incremental changes without re-inventing the wheel.  Includes a concise and readable summary of the IETF PKIX4 Framework by Santosh Chokhani and Warwick Ford.   (Copyright 1998 Labcal Technologies, Inc., All Rights Reserved. By Permission). Francois Marinier, J.F. Sauriol, and David Cramm of Labcal are all active in the ABA Information Security Committee PKI Accreditation WorkGroup.

Sept 1995 - Article "Monogamous, Promiscuous and Polygamous Models of Electronic Commerce" by Charles R. Merrill of McCarter & English, LLP, in The EDI Law Review 2:107-116 (Kluwer Academic Publishers, The Netherlands, September 1995)  A very early analysis of the concept that "one size does not fit all" when designing business models of PKI.  Traditional bilateral EDI between frequent trading partners is described as a "monogamous model," the Internet many-on-many interactions among strangers is characterized as "promiscuous", and a contractual/membership model is characterized as "polygamous."