Subject: RE: LDAP Schema

From: Andrew Probert <[email-masked]>
Date: Thu, 19 Nov 1998 09:32:17 +1100

In a former life (about a year ago), I went down this path and had
hardware crypto integrated to an NT / IIS3 server, to implement 128 bit
crypto.

The primary reason for this was for improving trust / key management.  

As it turned out, software based crypto in SSL is awfully fast (but a
bit variable depending on which vendor you get it from), so unless you
are careful you may end up implementing hardware decelleration.  The
approach we took was to have Server Private Key and Certs in hardware
board and the rest was done in software i.e. SHA1, RC4, MD5 et al.

I think your best bet for performance numbers will be with the vendors
of said crypto accelerator boards.    

Also, you could exchange emails with the guys of SSLEAY fame (Eric Young
and Tim Hudson) as they have trod these paths.

Andew Probert
Rotek Consulting 
a Division of Secure Network Services
+61 3 9690 8877

> -----Original Message-----
> From:	David Sweigert [SMTP:[email-masked]]
> Sent:	Wednesday, November 18, 1998 10:10 AM
> To:	Trevor Freeman; 'John Hughes'; [email-masked]
> Subject:	RE: LDAP Schema
> 
> 
> Has anyone in the group run across sources of information
> RE: use of digital certificates with Web SSL and the accompanying
> server performance problems and need for hardware accelerators ?
> 
> Dave Sweigert
>  
> 
> At 10:21 AM 11/17/98 -0800, Trevor Freeman wrote:
> >Hi John,
> >The Exchange schema is not extensible so you cannot add these
> classes.
> >however, the mailbox objects do already have a UserCertificate
> attribute
> >and there is also a CertificateAuthority object in these schema which
> has
> >most of the required attributes such as CACertificate and
> >certificateRevocationList etc. If you open the directory in Raw mode
> you can
> >see these objects and all of their attributes. 
> >
> >Trevor
> >
> >
> >-----Original Message-----
> >From: John Hughes [mailto:[email-masked]]
> >Sent: Tuesday, November 17, 1998 6:38 AM
> >To: [email-masked]
> >Subject: LDAP Schema
> >
> >
> >Has any one tried to configure Exchange Directory Server 5.5 to
> support the
> >pkiUser and pkiCA object classes.  Is it possible?
> >
> >
> >John
> >
> >
> >
> > -------------------------------------------------------------------
> >| John Hughes             [email-masked]                 |
> >| ENTEGRITY Solutions     Home Office Tel:       +44(0)1525 380160  |
> >|                         Home Fax No:           +44(0)1525 380161  |
> >|                         Main Office Tel:       +44(0)181 876 8666 |
> >| www.entegrity.com       Mobile:                +44(0)468 055070   |
> > ------------------------------------------------------------------- 
> >