Subject: RE: Missing Protocol ?

From: Peter Sylvester <[email-masked]>
Date: Thu, 20 Apr 2000 10:11:49 +0200 (MET DST)

> I am not sure that the problem the proposed protocol is addressing is the
> real problem.

I realised that Denis and I had been talking about two different things. 
So be it. 

It seems that the interest it to 'publish' some attributes that are
kept by the RA/CA....

> 
> I do not think that the protocol will be something of a frequent use: If an
> entity can not be uniquely and unambiguously identified without some extra
> 'with-the-beard' information, that information should be present in the
> entity's certificate. You do not want to reach out and ask an RA for extra
> details about the entity every time you deal with that entity. It is just
> going to be a pain. Therefore, I do not think we have a real requirement
> here. Passing it over to the "unique ID" thread :)

... a passport number, its validity date, my bank account number, etc. are
not necessarily available in the ID cert, but they can be made available
in one or more attribute certs, for example. 

I had in mind a completely unstructured set of scanned copies of
paper documents, but even that could be encapsulated in an attribute cert.

> I am not convinced that the protocol is necessary for infrequent use either:
> When a judge or police, or anybody else needs more information about the
> entity, an RA can be contacted directly. You do not really need a protocol.
'contact directly' means what? ...

> A judge, police etc can do it by phone, by fax, by email or by face to face.
> As they do it now, conveniently and simple enough. 

This is the bottom line of the question. To replace existing methods, for example:

- An RA can always issue an attribute cert for all the attributes that they
  store, be it just as a convenient way to fix the content of its user data base,
  or be it to inform the user about what has been stored about him.

- There are methods/protocols to "publish" certificates, or to give
  controlled and secured access to them.

> 
> As a bottom line: if a protocol is not going to be used frequently, and we
> can get by without it for occasional need, do we need the protocol at all?

I think we don't need a new one. 

Peter

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 20 Apr 2000 18:44:58 +0200

Michael and Peter,

I use this E-mail to comment on your answers.

> It seems that the interest it to 'publish' some attributes that are

Correct.

> > entity's certificate. 

Two arguments: 
1) The European Directive explicitly allows for the use of a
pseudonym. 
2) There is no requirement at all that the information that is
present in the certificate allows to identify unambiguously the
person.

> > You do not want to reach out and ask an RA for extra
> paper documents, 

Yes, this is a good example.

> but even that could be encapsulated in an attribute cert.

I do not think so. None of that information needs to be in an
Attribute Certificate. That information is useful for Public Key
certificates and does not relate to Attribute Certificates.

> > As they do it now, conveniently and simple enough.

Everything can be done slowly by the communication means from the
60's. :-) We are trying to use faster techniques for the millenium.
:-)

>   or be it to inform the user about what has been stored about him.

Attribute Certificates are quite new and new frequently used (if
used). As stated above, the problem does not directly relate to
Attribute Certificates.

>   controlled and secured access to them.

Yes, but the information that is needed is NOT in the certificate.

> > can get by without it for occasional need, do we need the protocol at all?

When we will have a significant deployment of a world-wide PKI, this
protocol will be more and more useful/needed. We are trying to
anticipate the needs.

Regards,

Denis