Subject: RE: X509 ACs - Too late, too little

From: Michael Zolotarev <[email-masked]>
Date: Wed, 8 Nov 2000 10:43:56 +1100

Anders,

It is just an encoding, not the principle of AC you are questioning now,
aren't you?

IETF AC profile is a *profile*. Which means it *profiles*, or specialises on
broad definition of AC by ISO in X509. ISO uses ASN1 encoding. So does the
IETF's profile. Departing from ISO conventions, for whatever reason,
wouldn't be prudent, at least at that stage. When, and if, XML-based PKI
takes off and cheered by the industry, there should be enough influence to
have ISO/IETF reevaluate their approach to encoding. 

XACL is a language that Alphaworks trust establishment solution uses to
describe their transitive recognition and verification rules. It has nothing
to do with AC, if I recall it right. Guys from AlphaWorks, Yosi, where are
you? 

Michael

> -----Original Message-----
> From: Anders Rundgren [mailto:[email-masked]]
> Sent: Wednesday, 8 November 2000 0:59
> To: Rich Salz
> Cc: PKIX-List
> Subject: Re: X509 ACs - Too late, too little
> 
> 
> Rich,
> 
> > I'm confused.  Why is an XML-based signature "competition" 
> with an AC?
> > Isn't it more in "competition" with PKCS#7?
> > /r$
> 
> This is correct.  XML-sig is a replacement for PKCS #7.
> 
> However, I see no problems in creating an AA-signed 
> "attribute container" in
> XML based on the W3C/IETF draft in progress.  That could 
> functionally replace a X509 AC.
> 
> Such a system would inherit the advantages of XML like the "schema",
> and the (very) likely broad acceptance in the commercial world.
> 
> A better mousetrap IMO.
> 
> BTW, when I downloaded the IBM AlphaWorks code I found 
> something called
>              XACL - XML Access Control Language
> so *maybe* there is some kind of XML AC out there already!!!
> 
> /Anders
> 
> 
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 8 Nov 2000 08:47:26 +0100

Hi Michael,

> It is just an encoding, not the principle of AC you are questioning now,

That's right.  *This* time I only addressed the format issue :-)
 
> have ISO/IETF reevaluate their approach to encoding. 

Departing from ISO conventions for a thing that is new, not established, and
even not recognized as useful by all parties does IMO not seem too unreasonable.  If
the IETF prefers to wait until XML is "everywhere", the chance to actually
do something on IETF's part becomes very slim.  It seems that PKI + XML are
quickly becoming "hot" which may call for other measures than when PKI was just
something folks from academia loved to talk about.

> to do with AC, if I recall it right. Guys from AlphaWorks, Yosi, where are

Oops! You are correct.  I read the paper briefly and in too much haste!
(Some parts may apply though as there are ways to express roles etc. that could
fit an XML-AC)

Anders