Subject: Re: Comments on draft-ietf-pkix-ldap-v3-01.txt

From: "David Chadwick" <[email-masked]>
Date: Thu, 6 Jul 2000 19:33:54 +0100

Date sent:      	Sat, 30 Oct 1999 14:51:32 -0400
From:           	Sean Turner <[email-masked]>
Organization:   	IECA, Inc.
To:             	PKIX <[email-masked]>
Subject:        	Comments on draft-ietf-pkix-ldap-v3-01.txt

> 
> After thinking about the draft a bit I'd like to suggest a few
> modifications (mostly organizational).
> 
> The draft includes both the protocol and schema issues to deal with
> LDAPv3 servers.  I think we should split the two topics as the draft
> is called "operational protocols".  I think the draft should just talk
> about the protocol issues and not the schema. 

After some thought and discussion with other LDAP folk I agree 
with you. One of the reasons is that the LDAPExt group will be 
updating the base LDAPv3 docs in due course and the schema stuff 
should go in there. (But this will be over a longer time frame than is 
needed to publish the protocol part). I am currently doing the 
changes now in time for Pittsburg.

> My suggestion is to
> update RFC 2587 (Internet X.509 Public Key Infrastructure LDAPv2
> Schema) to include the attribute and object classes required to
> support attribute certificate users.  Then the LDAPv2 schema could
> support storing the attribute certificate related information. 
> Another draft should be spawned to include specific LDAPv3 schema
> issues such support for matching rules, etc.

I will talk to Sharon B about this, as to whether she wants to update 
the v2 schema doc or not, or put the whole lot in a new schema doc 
leaving the existing RFC as is. (After all, we are not aware of any 
defects in that doc, are we?). I would favour just one new schema 
doc, which preferrably should be published by the LDAPExt group 
as these are core schema requirments in my opinion. However, I 
will produce the first draft of this.

> 
> There is support for the pmiUser but where are the attribute
> authority's certificates stored?  Should we define an pmiAA (name to
> be determined) object class to support storing of the attribute
> certificate for the AA?

this is now in X509

> 
> Also, which revocation list includes the revoked attribute
> certificates?  I assumed it would be stored in a separate attribute
> certificate revocation list, but the draft is silent on the issue (so
> is draft-ietf-pkix-ac509prof-01.txt).

X.509 defines attributeCertificateRevocationList and 
attributeAuthorityRevocationList. I dont believe PKIX needs to do 
anything more.

David

> Thanks,
> spt

***************************************************

David Chadwick
IS Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
Mobile +44 790 167 0359
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************

---

From: Sean Turner <[email-masked]>
Date: Tue, 11 Jul 2000 15:44:52 -0400

David,

Comments in line.

> changes now in time for Pittsburg.

Great - I think this will make it a lot clearer.

> > be determined) object class to support storing of the attribute

That's where I got the idea from ;)  I was just wondering if you were going
to put in some text to say use the attribute defined in X.509 to store the
AA's certs.  All I'm looking for is implementation guidance.

> attributeAuthorityRevocationList. I dont believe PKIX needs to do

Same as with the AA's certificate.  I was just hoping to see some text that
says use attributes X and Y to store the ACRL and AARCL objects.

Cheers,

spt