Subject: storing certificates "as is"

From: David Chadwick <[email-masked]>
Date: Wed, 12 Dec 2001 22:26:56 +0000

Does anyone know where there is text that states that a server must
return exactly the same information (attribute value) that was presented
to it, either always or when the ;binary encoding is used. This is
obviously essential for all signed values eg certificates, CRLs etc.
Before I add this text into every schema definition for signed objects,
it would be nice to know that a LDAPv3 bis document already contained
text along these lines as a general statement, rather than making it
specific to signed attribute values

thanks

David

-- 
*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 161 745 8169
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Understanding X.500:  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 13 Dec 2001 19:06:51 -0700

At 03:26 PM 2001-12-12, David Chadwick wrote:
>to it, either always or when the ;binary encoding is used.

To the best of my knowledge, there is no mandate that servers
preserve values nor their representations.  The technical
specification hints at a few cases (including ;binary) where
the representation may not be preserved and at least one case
(directoryString) where the values may not be preserved.

>This is obviously essential for all signed values eg certificates, CRLs etc.

One would think that value preservation would be essential for
many applications, and, for some applications (e.g., signed data),
the preservation of the representation is as well.  It would be
quite appropriate for applications needing preservation of values
or preservation of representation of values to state so in
applicability statement.  They likely should do on a per syntax basis.

That is, an LDAP applicability statement for PKI applications should
state that servers shall preserve values and preserve representation
of values for select syntaxes (certificates, CRLs, etc.).

>text along these lines as a general statement, rather than making it specific to signed attribute values

It doesn't.  This lack of a mandate should be discussed in the
technical specification.

Kurt

---

From: Kathy Dally <[email-masked]>
Date: Fri, 14 Dec 2001 03:16:40 -0500

Hi Kurt!

I think you are referring to draft-ietf-ldapbis-ldapv3-ts-00?

Thanks,
Kathy

"Kurt D. Zeilenga" wrote:
> many applications, and, for some applications (.g., signed data),