Subject: Re: Objections to advancing the attribute certificate authentication draft

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 16 Oct 2000 09:59:44 +0200

Tim,

>Bob - One of the main reasons for favouring a collection of attribute certificates over
>a collection of public-key certificates for asserting privilege is that one of the main 
>costs associated with public-key certificates is that related to the management of the
>corresponding private key.  The private key has to be secured for confidentiality 

You are right but I felt that the core of Bob's criticism of ACs is not based on security
issues but rather on the business case (applications if you prefer) for ACs.

I wholeheartedly agree with Bob that the use of ACs between organizations is highly dubious
but if ACs become an RFC or not is something I care less about.  I.e. a standard that
no one uses is IMO "harmless".

ACs are though redundant as:
- ACs have no support in the commercial world including browsers.  Never will.
- ACs are in the "wrong" format: ASN.1.  XML is what's counts in e-business
- ACs are like PKCs originally thought of replacing paper credentials in an off-line world. In
an on-line world authority can be delivered directly from the source which make issuing,
distribution, validity, and revocation essentially "no-issues".

Internally there are other solutions such as Kerberos, Externally ACs complicate things
more than they solve.

An AC RFC cannot change these basic facts!

BTW, are ACs also anticipated to be used in conjunction with digital signatures?
Anyone written a paper on that?

Anders Rundgren
Senior Internet e-commerce Architect
X-OBI AB

---

From: François-Frédéric Ozog <[email-masked]>
Date: Mon, 16 Oct 2000 17:04:22 +0200

Anders,

Since January I was trying to solve a business problem then I came to a
conclusion to the need of a new concept. Investigated it and found something
closse to AC. In fact I can use AC as a building block. Checking IDs and
signing e-mails are a nice to have: that's why PKIs haven't yet been really
deployed.What you can build with AC will become a must have and I expect it
to drive PKI implementations.

Stephen, Polar

I think that Polar addressed a number of valid points but we are looping in
circles to get them fixed: I am not sure I make a list of all of them to
address them one by one. I creates a climate of uncertainty that raises
doubts in Bob's mind.
Can you help better structure the resolution of those issues.

From my perspective, I see two main objections:

1) How holder is identified ?
Certificate, DN, ...

2) Can you trust DN way to assign attributes ?

3) How trust can be built in PKI ?
a) From a business standpoint
b) From a technical standpoint

Clearly points number 3a and 3b are a very interesting general PKI problem
but should not impact AC.

FFO