Subject: Re: Missing Protocol ?

From: "David P. Kemp" <[email-masked]>
Date: Fri, 21 Apr 2000 09:50:00 -0400 (EDT)

> From: Denis Pinkas <[email-masked]>
> 
> I see no reason for this. AAs (Attributes Authorities) are not the
> same like RAs (Registration Authorities).
> The response comes from the RA, not an AA. In any case the use of
> AAs is not mandated.

It's a question of assurance.  If you trust a directory, you don't need
signed attributes.  I lean towards end-to-end security whenever
possible, and therefore prefer the RA to sign attributes rather than
having the directory dish out unprotected information.  If the
authoritative RA database is available online, there is little reason
to prefer signed over unsigned.  But as soon as the information is
replicated, cached, passed along, or otherwise distributed, the RA's
signature becomes helpful.  When the RA signs attributes, it becomes,
by definition, an AA.

Regards,
Dave

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 21 Apr 2000 16:24:02 +0200

> signature becomes helpful.  When the RA signs attributes, it becomes,

Certainly not. Using AC mandates a very precise data structure. So
it is not because the answer is signed that the RA becomes an AA.
Note that the RA may respond without any signature and that the
security may be provided using, e.g. TLS.

Anyway the intent is not to place that information in multiple
untrusted Directories, but to query one server (ain the same way
this is done for OCSP). The idea is to allow to locally store that
information in some data base that could be queried using LDAP. 

Regards,

Denis