Subject: Q. Automatic certificate selection for signing

From: "Marc Poulaud" <[email-masked]>
Date: Tue, 14 Jan 2003 21:35:11 -0000

A question for those involved with signing applications (or anybody else
with 2 cents)...

I'm interested to understand what might be some of the key issues/options
for a signing application that needs to select the right certificate for
signing a piece of data. I see two main options. One is that there is a
configuration option that allows a particular user to be associated with a
particular certificate (a la Outlook - I want to use this certificate (and
associated key) to sign my outgoing emails). Another is that, during the
signing operation, some how select the right certificate based on a value
coded in a certificate.

On the one hand I think the latter would be a smart move if it where
possible to use some standard (and therefore interoperable) way of doing
this (unlike my initial thought of having an 'application' specific value
in an OU field) or perhaps a more suitable field within a certificate
(perhaps a policy qualifier?).

Anybody have experience of such matters?

Marc.

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 15 Jan 2003 08:18:03 +0100

Marc,
The only techically working solution for Web-signing is schemes like the one used in HTTPS/SSL where the relying party indicates the issuer etc. of accepted certificates.   This is already a part of the next-generation mobile-phone system developed by PKIX's Magnus Nyström et al.

Anders
  ----- Original Message ----- 
  From: Marc Poulaud 
  To: Ietf-Pkix@Imc. Org 
  Sent: Tuesday, January 14, 2003 22:35
  Subject: Q. Automatic certificate selection for signing

  A question for those involved with signing applications (or anybody else with 2 cents)...
   
  I'm interested to understand what might be some of the key issues/options for a signing application that needs to select the right certificate for signing a piece of data. I see two main options. One is that there is a configuration option that allows a particular user to be associated with a particular certificate (a la Outlook - I want to use this certificate (and associated key) to sign my outgoing emails). Another is that, during the signing operation, some how select the right certificate based on a value coded in a certificate.
   
  On the one hand I think the latter would be a smart move if it where possible to use some standard (and therefore interoperable) way of doing this (unlike my initial thought of having an 'application' specific value in an OU field) or perhaps a more suitable field within a certificate (perhaps a policy qualifier?).

  Marc.

---

From: Vadim Fedukovich <[email-masked]>
Date: Wed, 15 Jan 2003 14:01:06 +0200

> signing operation, some how select the right certificate based on a value

Maybe one can think signing with what key will be acceptable by
recipient or relaying party. Having access to too many keys might
undermine confidence in signatures made with that keys.
Yes, password- (or better) protected roles/profiles looks not bad.

> Anybody have experience of such matters?

Mastercard wallet (SET protocol) allow to pickup a password-protected
user profile and then use card-specific keys to sign protocol messages.

regards,
Vadim
-- 
Naina library: http://www.unity.net/~vf/naina_r1.tgz