Subject: RE: Q: Where should do I put a max amount in a X.509v3 certificat e?

From: "Yee, Peter" <[email-masked]>
Date: Fri, 8 Mar 2002 11:45:51 -0800

Tim suggests using a policy qualifier, private extension, or
subject directory attribute.  (And OCSP, with which I really have
to disagree respectfully).  I'll offer another alternative: attribute
certificates.  These seem to be a natural fit and were suggested for
just such a purpose.

Sure, I'm glossing over the plethora of software that actually
supports ACs, but most of the other suggestions aren't implemented
either. :-)

						-Peter Yee
						[email-masked]

---

From: Tim Polk <[email-masked]>
Date: Fri, 08 Mar 2002 16:56:38 -0500

Folks,

PKIX is scheduled for one two hour session from 1-3PM on Wednesday March 
20.  I have put together a draft agenda, which I have appended to the end 
of this message.

I believe the agenda satisfies all requests received to date.  The agenda 
is nearly full, but we can *probably* accommodate one or two more 
topics.  Please let me know *ASAP* if you have requested a slot and I 
overlooked you, or you meant to request a slot but hadn't done so 
yet...  the deadline for WG agendas is Wednesday noon, but I would prefer 
to be early this time.

Thanks,

Tim Polk

-------------------          Draft PKIX agenda for Minneapolis 
---------------------------

PKIX Agenda

I. Document Status Review (5 min.)			Tim Polk (NIST)

II. DPD/DPV Requirements and Protocol

	a. DPV Requirements Status (10 min.)	Denis Pinkas (Integris)	

	b. SCVP (20 min.)				Ambarish Malpani (ValiCert)

III. OCSP update (5 Min.)				Ambarish Malpani (ValiCert)	

IV. New Specifications

	a. ACRMF and ACMC IDs (15 min.)		Peter Yee (RSA)

	b. Policy requirements for TSAs (5 min.)	Denis Pinkas (Integris)		
	
V. Ongoing Specifications

	a. TSP interoperability testing update		Denis Pinkas (Integris)
	and anticipated to TSP (10 min.)	

	b. Permanent Identifiers (10 min.)		Denis Pinkas (Integris)	

	c. Proxy Certificates (10 min.)		Steve Tuecke (ANL)

	d. Logotypes (5 min.)			Stefan Santesson (AddTrust)

VI. Personal drafts

	a. DNS as X.509 PKIX Certificate		Jakob Schlyter (Carlstedt R&T)
	Storage (10 min.)		

	b. An LDAPv3 Schema for X.509		Peter Gietz (DAASI)
	Certificates (10 min.)

---

From: Dale Gustafson <[email-masked]>
Date: Mon, 11 Mar 2002 09:26:34 -0600

Hi Peter,

Actually, similar things are suggested in "Planning for PKI, Best
Practices for deploying the PKI" by Russ Housley and Tim Polk -- see the
section subtitled "Attribute Certificates", pp 274 - 277.  Note that the
entire chapter is titled "Future Developments" so, presumably, one needs
to proceed with appropriate caution.

In any event, the rationale for placing such an attribute within a
separate Attribute Certificate is clearly spelled out:

1) a Certification Authority is most likely "not authoritative" for this
kind of information

2) this kind of information is also likely to change frequently which
would cause highly undesirable certificate churn if included in x.509 v3
ID certificates.

In contrast, an application-specific attribute could be certified by an
authoritative AA and carried in an Attribute Certificate.  The AC is
defined as an extension of a suitable ID certificate.  Such would be
necessary but perhaps not sufficient for general use of ACs to convey
application-specific user priviledges.  For example, since much attribute
information is not disclosed outside a well-defined group of relying
parties, there would also need to be a (general purpose?) mechanism to
limit access to AC information exchanged.

Best Regards,

Dale Gustafson

---

From: Dr S N Henson <[email-masked]>
Date: Mon, 11 Mar 2002 23:47:19 +0000

> supports ACs, but most of the other suggestions aren't implemented

ACs might be more widely supported if some a few public examples of them
and their usage existed. I had a long search a while ago and couldn't
find a single sample. 

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Gemplus: http://www.gemplus.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.