Subject: Re: Holder (was Re: Comments on draft-ietf-pkix-ac509prof-05.txt)

From: "David P. Kemp" <[email-masked]>
Date: Thu, 2 Nov 2000 16:53:40 -0500 (EST)

> From: Eric Rescorla <[email-masked]>
>
> > ac509prof says "The profile places emphasis on attribute certificate
> > support for Internet electronic mail, IPsec, and WWW security
> > applications." So I expect that S/MIME, IPsec, and TLS would be the most
> > important protocols for this profile.
>
> TLS, at least, would need to be modified to use ACs. The issue is that
> RFC 2246 explicitly specifies the order in which certificates must
> appear:

No, TLS would need to be modified to *carry* ACs.  The server could
easily query a directory or database to fetch ACs once the client has
authenticated.  Since this wouldn't require client mods, and servers are
controlled by the information owners, TLS is likely to be one of the
first places where ACs are used.

Dave

---

From: Eric Rescorla <[email-masked]>
Date: 02 Nov 2000 14:12:39 -0800

"David P. Kemp" <[email-masked]> writes:

> No, TLS would need to be modified to *carry* ACs.
Quite so. Thanks for the clarification.

-Ekr