Subject: [Fwd: Re: PRQP Demo]

From: Leif Johansson <[email-masked]>
Date: Tue, 04 Dec 2007 22:29:22 +0100

Forgot to include the list.

    Cheers Leif

Subject: Re: PRQP Demo
From: Leif Johansson <[email-masked]>
To: Massimiliano Pala <[email-masked]>
Date: Tue, 04 Dec 2007 22:20:58 +0100

>
>
> I hope I addressed your question, if you have any other doubt and/or
> comments, please let me know. If I did not, can you provide examples on
> how PRQP and RFC3401-3405 are related ?
>
No :-) My suggestion was that you use DDDS to locate PRPQ servers
based on the presence of domain-names in altnames in certs. If you
say "just use AIA/SIA for PRPQ"  then you have just moved the
problem.

If the problem is "find resources for *existing* certificates" then you
either wind up with a (list of) well-known-service points (for PRPQ or
something similar) or a discovery service (possibly resulting in
pointers to PRPQ-servers) based on a managed namespace *already*
present in the certificates issued by deployed PKIs.

I agree that PRPQ is not a discovery service, I just mean that it won't
be useful without a discovery service.

    Cheers Leif

---

From: Massimiliano Pala <[email-masked]>
Date: Tue, 04 Dec 2007 17:47:31 -0800

Hi,

just to be sure I make my point clear, in PKIX we do not usually
put DNS names especially in CA certificates (which are the targets
here). Some CAs use DC="" or other DNS pointers, but it is not a
largely deployed name scheme (outside specific communities).
Anyhow, if any pointers are provided, it is mainly for EE certs
(e.g., subjectAltName).

When it comes to CA certificates, the presence of DNS-like pointers
decreases very rapidly... Maybe my first email was too long and this
point was a bit hidden between the lines... That is why we need to
map PKI services to certificates and not to DNS or other name-based
schemes.

Later,
Max

Leif Johansson wrote:
[..]

-- 

Best Regards,

	Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]            [email-masked]
                                                  [email-masked]

Dartmouth Computer Science Dept               Home Phone: +1 (603) 397-3883
PKI/Trust - Office 063                        Work Phone: +1 (603) 646-9179
--o------------------------------------------------------------------------