Subject: Re: PKIXML session. Was: PKIX WG tentative agenda

From: "Tom Gindin" <[email-masked]>
Date: Thu, 7 Dec 2000 18:17:40 -0500

IMHO the main advantage of XML over ASN.1 for any of these PKI
functions, including AC's, is the far greater number of developers who are
fluent in XML as compared to ASN.1 with BER or DER.  Speaking as one of the
relatively few who is more fluent in ASN.1 than XML, I know of no other
reason why XML should be preferred for such uses.  However, since syntax
difficulty may well have been one of the reasons why SMTP has become widely
adopted while X.400 has not, this is not a trivial reason.

          Tom Gindin

[email-masked] (Terry Hayes) on 12/07/2000 02:00:24 PM

To:   Polar Humenn <[email-masked]>
cc:   Tim Polk <[email-masked]>, [email-masked]
Subject:  Re: PKIXML session.  Was: PKIX WG tentative agenda

Polar Humenn wrote:

On Thu, 7 Dec 2000, Tim Polk wrote:

<snipped>

To be honest, I personally believe that XML is an
inappropriate encoding format for certificates (public key *or* attribute).

Forgive me, I'm just an academic. So, my I ask, what does the encoding
format really matter? And especially, why is XML "inappropriate" for
certificates?

At the end of the day, the encoding format doesn't really matter.  As long
as the required data is included in the payload, and all the parties
involved can decode and process the message, the desired results will be
acheived.

However,  there currently is a widely deployed and useful infrastructure
for certificates that uses ASN.1, DER and X.509 as the standard way of
representing the payload.  There are applications and protocols that use
this infrastructure such as TLS/SSL, S/MIME and even XMLDSIG that embed
these existing formats.  There is infrastructure developed and deployed for
generating these certificates.  There are standard interfaces to devices
that provided mechanisms for dealing with X.509 certificates (I'm thinking
of PKCS#11).

Why would you want to replace all of these just for the sake of "purity of
XML"?

Terry

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 8 Dec 2000 08:46:03 +0100

> adopted while X.400 has not, this is not a trivial reason.

Tom,
If you have followed my (too) frequent postings on the subject you should know that
there are actually *two* reasons for ACs to use to XML.  The second reason is the lack
of protocol and CA support for a certificate of the AC type.   By using a self-contained
signed object like PKCS #7, or in the XML-world XMLDSIG, the term "attribute certificate"
can be replaced by "signed attribute container" and make the AC replacement belong to
the same league as signed purchase orders etc.  And use *identical* PKI support code.

Using schemes like S2ML, the currently missing AC PUSH support, is already available w.o.
changing a single bit in the underlying PKI systems, protocols and browsers!

Given these facts I am willing to bet on that PKIX-ACs will be virtually insignificant.
Anyone interested in challenging this???

Anders