Subject: [ESDS] ESDS vs x.509

From: Robert LISIAK <[email-masked]>
Date: Fri, 23 Nov 2007 12:45:14 +0100

Bonjour Messieurs,

I read your three drafts with great interest.

The ESDS scheme introduces some signed keys (x.509) exchange notions.

I did not find or not been able to find in these three drafts any  
notion about the interoperability of certificates origins from a  
different authority.

Even if the security is the WP4 business and/or lower OSI layers I  
think that the calls like  "x509containerParse";  
"x509containerCompare" etc. should be a part of concepts, scheme and  
ESDS commands.

What are your ideas, gentlemans ?

==== snip draft-thompson-esds-schema-02.txt ====
2.1.77.  tX509CertItemList
    o  Description:
       A list of X.509 certificate items.
    o  Attributes:
       *  "action"
          +  Desc: X.509 certificate list action
          +  Type: tListAction
          +  Use: optional
    o  Elements:
       *  <cert>
          +  Desc: X.509 certificate
          +  Type: tX509CertItem
          +  Use: zero or more occurrences

==== snip draft-thompson-esds-commands-02.txt ====
*  <authorizedCertList>
          +  Desc: authorized certificate list
          +  Type: tX509CertItemList
          +  Use: optional, but no more than 1 occurrence(s)

-- 
robert.lisi@k
+33 687.77.65.73
ICQ UIN : 179675117
<><
----------------------------------
system and network security advise
not another RFID company member
----------------------------------

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

_______________________________________________
ESDS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/esds

---

From: Frank Thompson <[email-masked]>
Date: Mon, 26 Nov 2007 20:35:14 +0000 (UTC)

> I did not find or not been able to find in these three drafts any notion
> about the interoperability of certificates origins from a different
> authority.
> 
> Even if the security is the WP4 business and/or lower OSI layers I think
> that the calls like  "x509containerParse"; "x509containerCompare" etc.
> should be a part of concepts, scheme and ESDS commands.
> 

Thank You Robert for your interest in the ESDS documents.

The X.509 certificate checks although add another level of security to the 
ESDS they also introduce too much implementation into the protocol.  The 
next release will not have this list of certificates as the indended 
feature can be easily handled by a PKI CRL.  This frees the interface from 
X.509 requirement that should not be present.

cheers
frank

> 
> ==== snip draft-thompson-esds-schema-02.txt ==== 2.1.77.  tX509CertItemList
>     o  Description: