Subject: [pkix] Revised Submission: claimSigning EKU draft for PKIX WG Consideration

From: Matt King <[email-masked]>
Date: Tue, 27 Dec 2011 08:59:35 -0500

Dear PKIX Working Group

Happy Holidays!  I have posted an updated draft document describing
the claimSigning
EKU.  It is titled “draft-king-pkix-claimsigning-extn-03.txt”
(abstract below) and it can be found at the following link for your
review:

http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1

This revised draft replaces "draft-king-pkix-claimsigning-extn-02.txt".

I ask that the attached draft be considered as a new work item for
this group.  Thank you in advance for your time.

Matt
--
Matt King
Protiviti Inc.
Government Services
[email-masked]
[email-masked]
410-271-5624 (Mobile)

ABSTRACT
This document specifies an Extended Key Usage (EKU) value which
   indicates that the certificate holder is authorized to sign security
   tokens to assert claims, or attributes, about a subject.

   When a certificate that asserts the claimSigning EKU signs a claim,
   the owner of the service holding that certificate is asserting that a
   statement about the subject is true. For example, a IdP secure token
   service (STS) would use an X.509 certificate containing the
   claimSigning EKU to sign SAML assertions containing an identifier and
   attributes about a user. This EKU value would allow for a separation
   between the designation that a given Identity belongs within a given
   Federation, and the empowerment of that entity within the federation
   to sign claims..  This approach allows for greater flexibility for
   the operators of Federated systems and for Certification Authorities
   and avoids the overloading of other, already established methods
   (such as Assurance Level designation via certificatePolicy OID).

On Fri, Oct 28, 2011 at 12:53 PM, Matt King <[email-masked]> wrote:
> Dear PKIX Working Group
>
> I have posted an updated draft document describing the claimSigning
> EKU.  It is titled “draft-king-pkix-claimsigning-extn-02.txt”
> (abstract below) and it can be found at the following link for your
> review:
>
> http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1
>
> This revised draft replaces "draft-king-pkix-claimsigning-extn-01.txt".
>
> I ask that the attached draft be considered as a new work item for
> this group.  Thank you in advance for your time.
>
> Matt
> --
> Matt King
> Protiviti Inc.
> Government Services
> [email-masked]
> [email-masked]
> 410-271-5624 (Mobile)
>
> On Wed, May 25, 2011 at 3:36 PM, Matt King <[email-masked]> wrote:
>> Dear PKIX Working Group
>>
>> I have posted an updated draft document describing the claimSigning EKU.  It is
>> titled “draft-king-pkix-claimsigning-extn-01.txt” (abstract below) and
>> it can be found at the following link for your review:
>>
>> http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1
>>
>> This revised draft replaces both the initial draft
>> "draft-king-pkix-claimsigning-extn-00.txt"
>> and "draft-patterson-pkix-attribute-signing-eku".  The authors of both
>> drafts have
>> collaborated and addressed all comments received to date and are
>> moving forward with this single submission.
>>
>> I ask that the attached draft be considered as a new work item for
>> this group.  Thank you in advance for your time.
>>
>> Matt
>> --
>> Matt King
>> Protiviti Inc.
>> Government Services
>> [email-masked]
>> [email-masked]
>> 410-271-5624 (Mobile)
>>
>>
>> Abstract
>>
>>   This memo specifies an Extended Key Usage (EKU) X.509 certificate
>>   extension which indicates that the certificate holder is authorized
>>   to sign security tokens to assert claims, or attributes, about a
>>   principal.
>>
>>   When an owner of a certificate that asserts the claimSigning EKU
>>   signs a claim, the owner is asserting that a statement about the
>>   principal is true. For example, a IdP secure token service (STS)
>>   would use an X.509 certificate containing the claimSigning EKU to
>>   sign SAML assertions containing an identifier and attributes about a
>>   user. This additional EKU value would further allow the
>>   differentiation of certificates used to identify a particular server
>>   from those used by the server to sign identity or attribute claims.
>>
>>
>>
>>
>> On Fri, Apr 22, 2011 at 1:51 PM, Matt King <[email-masked]> wrote:
>>> Dear PKIX Working Group
>>>
>>> I have posted an draft document describing a claimSigning EKU.  It is
>>> titled “draft-king-pkix-claimsigning-extn-00.txt” (abstract below) and
>>> it can be found at the following link for your review:
>>>
>>> http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1
>>>
>>> I ask that the attached draft be considered as a new work item for
>>> this group.  Thank you in advance for your time.
>>>
>>> Abstract
>>>
>>>   This memo specifies an Extended Key Usage (EKU) X.509 certificate
>>>   extension which indicates that the certificate holder is authorized
>>>   to sign security tokens to assert claims, or attributes, about a
>>>   principal.
>>>
>>>   When an owner of a certificate that asserts the claimSigning EKU
>>>   signs a claim, the owner is asserting that a statement about the
>>>   principal is true. For example, a IdP secure token service (STS)
>>>   would use an X.509 certificate containing the claimSigning EKU to
>>>   sign SAML assertions containing an identifier and attributes about a
>>>   user.
>>>
>>>
>>> --
>>> Matt King
>>> Protiviti
>>> Government Services
>>> [email-masked]
>>> [email-masked]
>>> 410-271-5624 (Mobile)
>>>
>>
>>
>>
>> --
>> Matt King
>> [email-masked]
>> 410-271-5624 (Mobile)
>>
>
>
>
> --
> Matt King
> [email-masked]
> 410-271-5624 (Mobile)

-- 
Matt King
[email-masked]
410-271-5624 (Mobile)