Subject: RE: Objections to advancing the attribute certificateauthentication draft

From: "Sergio Tabanelli" <[email-masked]>
Date: Mon, 16 Oct 2000 16:18:27 +0200

Hi all

I know that my knowledges on PKI dosen't stand comparison with those owned
by people participant to this open forum, so please forgive me if the
following comments will seems to you semplicistics and conceited.
I think that one of the problems of the actual use of PKCs is that all of
the Public Administrations, Finantial Institutes and private companies that
use this technology are self issuing their certificates, the risk I am
seeing is that everyone will have dozens of Smart cards or crypto devices in
his pocket or purse, everyone containing a key binded with a PKC issued
under its specific policy and with its specific extensions and keyusage. I
know that the universal CA solution is not a good answer, but I think that
milions of CAs everyone crosscertifing each other is not the right solution
too. IMHO a possible solution is few country based CAs that focus their
activity on certification of individual identities with different levels of
recognitions. Identity certs without any usage reference (keyusage,
extkeyusage, extensions and policy multiplications, ...) and standard
application protocols can help to reduce CA proliferation, semplify policies
and clarify responsabilities assignment. What I am saying is that we don't
need PKC with lots of attributes and extensions but different application
protocols and objects (AC is one example) for different purbose, everyone
based on an identity object, the PKC. Maybe this can be considered banal and
semplicistic but for analogy if "x" is the PKC, and we need y as y=f(x) i
think is better to work on f rather then on x. In conclusion IMHO things
like ACs or new signature protocol like signature policies, signature
request and so on can do the job and help people using this technology,
things like keyusage, non repudiation bit, big PKCs with all in, not.

P.S.
I think that two parties with two distinct rules, authorization issuer and
authorization verifier, can agree to use PKCS7 or CMS with signed attributes
to reach same results as with ACs, I consider ACs as a standard and more
suited way (flawed or not) to do this useful thing.

Sergio Tabanelli