Subject: RE: certificate and attribute certificate imported from PKIX or X .509

From: "Pawling, John" <[email-masked]>
Date: Thu, 22 Mar 2001 13:41:39 -0500

Sean,

The Certificate ASN.1 syntax definitions in the PKIX and X.509 specs are
equivalent (i.e. they produce identical hex ASN.1 encodings), so it doesn't
matter to me which spec is referenced.

However, the AttributeCertificate syntax is an issue.  RFC 2630 imports the
AttributeCertificate syntax from the 1997 X.509 Recommendation.  The
AttributeCertificate syntax defined in the draft 2000 X.509 Recommendation
(X.509_4thEditionDraftV7, 23 Feb 2001) and PKIX AC Profile
(draft-ietf-pkix-ac509prof-06.txt, 10 Jan 2001) is incompatible with the
AttributeCertificate syntax defined in the 1997 X.509 Recommendation.
Recommend that the son-of-RFC2630 and symkeydist ASN.1 modules should import
the AttributeCertificate syntax defined in the draft 2000 X.509
Recommendation and PKIX AC Profile (again, it doesn't matter to me which
spec is referenced).

===========================================
John Pawling, [email-masked]
Getronics Government Solutions, LLC
===========================================

-----Original Message-----
From: Sean P. Turner [mailto:[email-masked]]
Sent: Thursday, March 22, 2001 11:30 AM
To: SMIME
Subject: certificate and attribute certificate imported from PKIX or
X.509

All,

One of the comments I received on the symkeydist draft was to import
certificate and attribute certificate from the PKIX documents and not
from X.509.  The question is whether I should do this or not and if so
should CMS be changed to do the same?

spt

---

From: "Sean P. Turner" <[email-masked]>
Date: Thu, 22 Mar 2001 14:12:40 -0500

John,

Thanks for the quick though.  I guess I'd rather use the PKIX references just
because it is an IETF standard :)

spt

---

From: Dr S N Henson <[email-masked]>
Date: Thu, 22 Mar 2001 21:33:00 +0000

> Recommendation and PKIX AC Profile (again, it doesn't matter to me which

I'm trying to work out whether that statement implies that the draft2000
X.509 Recommendation and the PKIX AC profile are compatible :-)

I sent a query about that to the PKIX list without response a while ago.
There seems to be one (unintentional?) incompatibility at least. The
PKIX draft has in the ASN1 module (Appendix B):

DEFINITIONS EXPLICIT TAGS ::=

whereas the X509 2000 draft has:

DEFINITIONS IMPLICIT TAGS ::=

The 1997 X.509 recommendation apparently does not change the default
tagging which would mean it should be EXPLICIT.

I've only ever seen one example of an attribute certificate and that
used default EXPLICIT tagging but it was broken in another separate way.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.