Subject: FW: Automatic certificate selection for signing

From: "Liaquat Khan" <[email-masked]>
Date: Wed, 15 Jan 2003 08:59:54 -0000

Hi Marc,

The client application could look at the KeyUsage extension, and from here
determine the correct certificate to be used for the task at hand (e.g.
signing or encrypting).  Alternatively the use of the Certificate Policies
extension is also not a bad idea, but you need to ensure your CA does
include this in the end-user's certificate.  Also you need to think about
what it will take for your client application to support new certificate
policy identifiers.  Note your certificate policy identifier may change
through a simple update of your certificate policy (e.g. change of address
or contact details), now how easy will it be to change all your client
applications to accept the new certificate policy identifier as well as the
old one?

Regards,
LK
  ----- Original Message -----
  From: Marc Poulaud
  To: Ietf-Pkix@Imc. Org
  Sent: Tuesday, January 14, 2003 9:35 PM
  Subject: Q. Automatic certificate selection for signing

  A question for those involved with signing applications (or anybody else
with 2 cents)...

  I'm interested to understand what might be some of the key issues/options
for a signing application that needs to select the right certificate for
signing a piece of data. I see two main options. One is that there is a
configuration option that allows a particular user to be associated with a
particular certificate (a la Outlook - I want to use this certificate (and
associated key) to sign my outgoing emails). Another is that, during the
signing operation, some how select the right certificate based on a value
coded in a certificate.

  On the one hand I think the latter would be a smart move if it where
possible to use some standard (and therefore interoperable) way of doing
this (unlike my initial thought of having an 'application' specific value in
an OU field) or perhaps a more suitable field within a certificate (perhaps
a policy qualifier?).

  Anybody have experience of such matters?

  Marc.
Liaquat Khan       Chief Consultancy Officer

     a leading provider of real-time Certificate Validation solutions

E-Mail: [email-masked]
Mobile: +44 7776 308 766

Adding Trust to your PKI

www.ascertia.com

The opinions expressed are those of the individual and not the company.
Internet communications are not secure and therefore the company does not
accept legal responsibility for the contents of this message.  If the reader
of this message is not the intended recipient, or the employee responsible
for delivering this communication to the intended recipient, you are hereby
notified that any disclosure, distribution or copying of this communication
is strictly prohibited.