Subject: Attribute Authorities

From: Massimiliano Pala <[email-masked]>
Date: Sat, 15 Nov 2008 16:23:18 +0630

Hi all,

I was wondering if there is a way to actually identify an AA based on the
contents of its certificate (eg., extendedKeyUsage, an extension, an
OID,... ) ?

How can a third party know that an Identity has been identified by a CA
as a valid AA ? I know that the problem of Identity and Authorization
should not be tied together - but it would be easier for an application
to know that an identity can sign attribute certificates. Is there anything
of the sort ? And if not, has anybody thought about it ?

Later,
Max

-- 

Best Regards,

	Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]  [email-masked]
                                                    [email-masked]

Dartmouth Computer Science Dept               Home Phone: +1 (603) 369-9332
PKI/Trust Laboratory                          Work Phone: +1 (603) 646-9179
--o------------------------------------------------------------------------

People who think they know everything are a great annoyance to those of us
who do.
							   -- Isaac Asimov

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 16 Nov 2008 09:42:47 +0100

I thought that an X509 AC is supposed to contain a binding to a PKC (or identity) and that you need 
to trust both CAs in order to get something useful out of this concept.  To me that sounds like that 
there already is a solution.

Talking about attribute authorities; what do you think about the Microsoft-originated Information 
Card scheme?
http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=imi
IMO it will do what ACs never did because it addresses real-world use-cases and is already supported 
by Vista, XP and Firefox platforms while the AC use-case(?) is poorly researched and client-side 
implementations are scarce to say the least.

Anders Rundgren

----- Original Message ----- 
From: "Massimiliano Pala" <[email-masked]>
To: "pkix" <[email-masked]>
Sent: Saturday, November 15, 2008 10:53
Subject: Attribute Authorities

Hi all,

Later,
Max

-- 

Best Regards,

Massimiliano Pala

---

From: Massimiliano Pala <[email-masked]>
Date: Sun, 16 Nov 2008 11:31:11 +0630

Hi Anders,

my question was different and it was related to how to identify an AA - which is
basically answered in rfc3281 in 7.4 (thanks Santosh).

Talking about attribute authorities, the AC has been researched extensively (an
example being the work from Chadwick and the current work within the OGF). It is
true, although, that client software implementations are not widely deployed
outside certain communities. I do hope this will change as soon as we will
improve the usability of PKIs :D

Later,
Max

Anders Rundgren wrote:
> I thought that an X509 AC is supposed to contain a binding to a PKC (or identity) and
> that you need to trust both CAs in order to get something useful out of this concept.
> To me that sounds like that there already is a solution.
> 
> Talking about attribute authorities; what do you think about the Microsoft-originated
> Information Card scheme? http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=imi
>  IMO it will do what ACs never did because it addresses real-world use-cases and is
> already supported by Vista, XP and Firefox platforms while the AC use-case(?) is poorly
> researched and client-side implementations are scarce to say the least.
> 
> Anders Rundgren

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 16 Nov 2008 18:56:00 +0100

Hi Max,
I have taken the liberty (?) of studying the AC use-case in the business world, including 
e-governments.

I came up with a solution that I consider a viable alternative to X509 ACs although the method can 
be used with such as well.
The basic concept is that the AA publishes signed XML "ACs" using high-entropy URLs (can't be 
guessed) and the client only forwards this URL like the following example:
http://webpki.org/attributecertificates/A.2006.10.0452/9j2g637gdHu3erh8udvh5ddyugdRd9Gw30fdu0pwetfkotgoi4218hfcsKeherufu.xml
It also makes revocation a simple thing, the AA just removes the AC or replaces its contents with a 
revoke notice.

ACs can also be created for human consumption:
http://webpki.org/attributecertificates/A.2006.10.0452/9j2g637gdHu3erh8udvh5ddyugdRd9Gw30fdu0pwetfkotgoi4218hfcsKeherufu.pdf

IMHO, core PKI does not need much additional innovation, it is rather the application of PKI that is 
problem.  There is an over-belief in complexity as the solution.

In case you  *really* want to make PKI more useful you should tell these guys
http://www.mel.nist.gov/msid/b2btestbed
how they should dress their scheme in PKI because their buddies at the computer security department 
obviously haven't a clue!
BTW, I would be happy to see the design as well...

Anders

----- Original Message ----- 
From: "Massimiliano Pala" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: "pkix" <[email-masked]>
Sent: Sunday, November 16, 2008 06:01
Subject: Re: Attribute Authorities

Hi Anders,

Later,
Max

---

From: Alan Sill <[email-masked]>
Date: Sun, 16 Nov 2008 15:26:51 -0600

Attribute authorities are features of virtual or real organizations,  
not CAs in general.  A give VO can have multiple CAs associated with  
it or accepted by its relying parties, none of which may be uniquely  
authoritative to assert that the AA itself is authentic.  In large- 
scale VOs that want to make such an assertion, a certificate from one  
of those CAs may be used to identify the AA service.  An example is  
the certificate checking built into some, but not all, of the relying  
party software that uses VOMS extended attribute certificates.  The  
responsibility to check the credentials of the AA belongs to the  
relying party, not to the CA.  They can do so by checking the  
credentials of the service that adds the extensions.

Alan

> of the sort ? And if not, has anybody thought about it ?

Alan Sill, Ph.D
Senior Scientist, High Performance Computing Center
Adjunct Professor of Physics
TTU

====================================================================
:  Alan Sill, Texas Tech University  Office: Admin 233, MS 4-1167  :
:  e-mail: [email-masked]   ph. 806-742-4350  fax 806-742-4358  :
====================================================================

---

From: Alan Sill <[email-masked]>
Date: Sun, 16 Nov 2008 21:36:45 -0600

Alan

Alan Sill, Ph.D