Subject: X.509 Certificate schema in LDAPv3

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 23 May 2001 08:06:54 -0500

LDAPbis is currently revising the LDAPv3 for publication
as a Draft Standard.  One of the significant issues in
which we are addressing is LDAP's relationship to X.500.
The consensus of the WG has determined it best that LDAPv3
only reference the one edition of X.500 and not both the
2nd and 3rd editions as the Proposed Standard did.  The
consensus of the LDAPbis WG is to only reference the 2nd
edition as this is what the protocol itself depends on,
and to drop the few schema elements from the "core" document
which are dependent on the 3rd edition.  As much of this
schema is broken anyways, this seems like the most reasonable
solution.

The most significant impact of this change is that the
X.509 certificate schema would be dropped from the "core"
documents and, hopefully, picked up in a separate document.
I note that the X.509 certificate schema is known to be
broken in LDAPv3, in particular the attributes are missing
key matching rules.

I understand that PKIX is working on an PKI profile for
LDAPv3 which includes additional X.509 certificate schema.
I would suggest that this work be expanded to include
new specification of the RFC 2252/2256 certificate schema
elements.

-- Kurt

---

From: David Chadwick <[email-masked]>
Date: Wed, 23 May 2001 18:03:49 +0100

Kurt

I am happy to include the schema definitions in the PKIX LDAP Schema
document.

David

-- 
*****************************************************************

David Chadwick, BSc PhD
Post: IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 161 745 8169
*NEW* Mobile: +44 77 96 44 7184 *NEW*
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Understanding X.500:  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************