Subject: X509 ACs - Too late, too little

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 7 Nov 2000 11:42:02 +0100

XML-signatures are apparantly coming on strong.
W3C now says the draft is in an advanced state.

And IBM has kindly provided a reference implementation for public use at:

http://www.alphaworks.ibm.com/tech/xmlsecuritysuite

So why would anybody bother with ASN.1-based ACs?

Neither ISO (particularly not ISO) nor the IETF can make ASN.1-based ACs
an implementors choice if they do not quickly come up with something similar.  And
who would be interested in doing that?  Sorry for being a PITA but I think
that the AC-project should immediately be retargeted to use XML instead of becoming
an RFC. 

Anders

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 07 Nov 2000 11:59:05 +0100

Anders,

> that the AC-project should immediately be retargeted to use XML instead of becoming

This mailing list, called PKIX, means "PKI using X.509 certificates". This
is what the "X" stands for. This mailing list does not deal with XML. ISO
has nearly completed the standard for ACs. In PKIX we define a profile for
this work. The market will decide to implement it or not.

If you are interested in XML and if you think it is appropriate, please
advocate XML ACs on the XML-DSIG mailing list <[email-masked]>
(i.e. not on the PKIX mailing list).

Denis

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 7 Nov 2000 12:27:23 +0100

Denis,

> is what the "X" stands for.

XML-signatures use X509 certificates and PKI AFAIK.

> This mailing list does not deal with XML. 

So PKIX cannot deal with any PKI-related structure if it is not already an ISO-std. and due to that
currently specified in ASN.1?

I.e. if you want to discuss XML-ACs you must do it somewhere else?
Even if it addresses the very same applications and "market" as X509 ACs?

Pardon me, did'nt know that.

/anders

---

From: Rich Salz <[email-masked]>
Date: Tue, 07 Nov 2000 08:31:40 -0500

I'm confused.  Why is an XML-based signature "competition" with an AC?
Isn't it more in "competition" with PKCS#7?
	/r$

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 7 Nov 2000 15:59:26 +0100

Rich,

> Isn't it more in "competition" with PKCS#7?

This is correct.  XML-sig is a replacement for PKCS #7.

However, I see no problems in creating an AA-signed "attribute container" in
XML based on the W3C/IETF draft in progress.  That could functionally replace a X509 AC.

Such a system would inherit the advantages of XML like the "schema",
and the (very) likely broad acceptance in the commercial world.

A better mousetrap IMO.

BTW, when I downloaded the IBM AlphaWorks code I found something called
             XACL - XML Access Control Language
so *maybe* there is some kind of XML AC out there already!!!

/Anders

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 7 Nov 2000 16:51:19 -0800

>XML-signatures are apparantly coming on strong.

For some value of "apparently". Please note that, even after the last 
call, people are still reporting technical changes that need to be 
made to the spec.

>W3C now says the draft is in an advanced state.

Yes, they have been saying that for quite some time.

>So why would anybody bother with ASN.1-based ACs?

This is a non-sequetor. XML signatures are signatures, they are not 
formats for certificates. As you point out, the XML DIGSIG draft (it 
is still not a standard) uses PKIX certificates.

--Paul Hoffman, Director
--Internet Mail Consortium