Subject: RE: SEIS: EID business model? Was CA certificates on smart cards)

From: Tarvi Martens <[email-masked]>
Date: Mon, 16 Nov 1998 10:18:12 +0200

Just couple of thoughts:

First, about directories and LDAP/DAP/X.500 in particular.
We should assume that delivery of certificates and CRL-s does not
require any special technologies. The public certificate should not
contain any confidential information, not talking about CRL-s. In
this case, just any (secured) WWW service should do. If one could
agree on certain rules on this kind of directory service (eg. WebCAP)
the life could be easier for all of us.

The most problematic thing as of today about X.509v3 certificates
(for me) is DN usage/subordination and usage of v3 extensions.
There are evidently different requirements on DN form and usage
of extensions for different
	- communities
	- usages
	- protcols/applications

By communities I mean CA -> certificate holder relationships eg:
	government -> citizen (EID case)
	government -> company
	government -> government (cross-country certification)
	company -> client
	company -> employee
	company -> company
	person -> person

It is evident that these relationships require different DN form (eg government
cannot tell your O= whether company doest not care much about your nationality 
;)

Some certificates are issued today for very specific usages, eg. "tax 
declaration only"
or "database access only".

Some protocols/applications like SSL, SET and S/MIME define usage of v3 
extensions
pretty clearly. However, they are not the only ones in the world.

Our common goal should be to facilitate growth of digital signature 
technologies
in general. We cannot do this top-down. Instead, we should allow for "everyone"
to start running CA services.

If we just could define a profile, regulating usage of DN attributes and v3 
extensions
depenging on community, usage and protocol... then this protocol would be
profitable to follow in order to get hooked with the overall (national, world, 
...) PKI.

Any thoughts or real activities towards this?

Best regards,

Tarvi Martens
Cybernetica