Subject: RE: X.509 Certificate schema in LDAPv3

From: "Slone, Skip" <[email-masked]>
Date: Wed, 23 May 2001 14:44:19 -0400

Kurt,

Could you please clarify what you mean by "As much of this schema is broken
... " and "... the X.509 certificate schema is known to be broken in LDAPv3
... ?"

In my capacity as the US Defect Editor for X.500, no one has EVER brought
any broken schema elements in the 3rd edition to my attention.

  -- Skip Slone

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]] 
Sent: Wednesday, May 23, 2001 9:07 AM
To: [email-masked]
Subject: X.509 Certificate schema in LDAPv3

LDAPbis is currently revising the LDAPv3 for publication
as a Draft Standard.  One of the significant issues in
which we are addressing is LDAP's relationship to X.500.
The consensus of the WG has determined it best that LDAPv3
only reference the one edition of X.500 and not both the
2nd and 3rd editions as the Proposed Standard did.  The consensus of the
LDAPbis WG is to only reference the 2nd edition as this is what the protocol
itself depends on, and to drop the few schema elements from the "core"
document which are dependent on the 3rd edition.  As much of this schema is
broken anyways, this seems like the most reasonable solution.

The most significant impact of this change is that the
X.509 certificate schema would be dropped from the "core" documents and,
hopefully, picked up in a separate document. I note that the X.509
certificate schema is known to be broken in LDAPv3, in particular the
attributes are missing key matching rules.

I understand that PKIX is working on an PKI profile for
LDAPv3 which includes additional X.509 certificate schema.
I would suggest that this work be expanded to include
new specification of the RFC 2252/2256 certificate schema elements.

-- Kurt