Subject: XACML OID tag?

From: "Bob Jueneman" <[email-masked]>
Date: Mon, 10 Sep 2001 09:41:42 -0600

This is join to sound like heresy, but has anyone defined an OID tag for XACML, so that an XACML string could be included in a X.509 certificate?

Now, I fully expect to be assailed from both sides for this question ― one for mixing XML into a bastardized certificate format instead of using pure ASN.1 as God obviously intended, and the other for daring to pour holy XML into such an impure, defiled, and unclean vessel as an X.509 certificate.

So be it, and let the flames begin.

But I'm observing that conventional, identity-based PKI is suffering what the medical community calls a "failure to thrive", with the sole exception being SSL certificates issued by the TTP CAs, with VeriSign obviously having the mind share in that space.

Toolkits which would provide enterprises to issue their own certificates have so far failed to take off to any significant degree (ours included), with the consequence that some of those vendors, who once flew so high, are close to being delisted by the NASDAQ.

One of the reasons, I believe, is that the neither the public TTPs nor the toolkit vendors have so far adequately addressed the important issue of providing a cross-enterprise Privilege Management Infrastructure solution.  And now that they are feeling a very significant financial pinch, they may not have the wherewithal to solve that problem.

Maybe it's just the religion of the week (XML) creating an evangelistic fervor, but that's where the buzz seems to be these days.  And I'd rather drop some XACML into an X.509 certificate and make use of the existing tools, rather than create everything from scratch.  And yes, if X.509 attribute certificates had been better thought out and/or more widely implemented, maybe this wouldn't be necessary. And if pigs could whistle and cows could fly, then the world would be a much different place.

Anyway, does anyone have such an OID and a suggested way to use it?  If not, I guess I'll explore rolling my own, unless someone else wants to join in the fun.

Bob

Robert R. Jueneman
Security Architect

Novell, Inc -- the leading provider of Net services software

---

From: Phil Griffin <[email-masked]>
Date: Mon, 10 Sep 2001 18:37:20 -0400

Bob,

Not sure if this is exactly what you're getting at,
but XML 1.0 markup is now a textual encoding of ASN.1
values based on ASN.1 notation (schema) and a new
part of the ASN.1 standards. 

XER is the XML Encoding Rules of ASN.1, and CXER
is a canonical form of XER, in the same manner that
DER is a canonical encoding of BER. CXER is suitable
for the same types of operations. I'm told that tool
support is will be available from vendors in the
fourth quarter of this year.

The new ASN.1 XML Value Notation is an alternative
to the ASN.1 Basic Notation which will be much more
familiar and natural to use for many folks. The values
are equivalent to current ASN.1 abstract values. This
means that it will be possible to send compact binary
encodings over the wire, but to decode them into more
verbose XML markup. Alternatively, the same abstract
values can be transferred as XML markup.

See http://asn1.elibel.tm.fr/en/xml/index.htm for 
more information. This page will be updated soon with
the meeting results and accomplishments of the last 
two weeks in Bangalore India as soon as folks recover
from travel.

There will be several new OIDs defined in the ASN.1 
standards; one to identify XML. Another being kicked
about will identify gZIPed encoded values. These OIDs
will be built into the standards. 

Phil Griffin

Bob Jueneman wrote:
> Now, I fully expect to be assailed from both sides for this question ¯ one for mixing XML into a bastardized certificate format instead of using pure ASN.1 as God obviously intended, and the other for daring to pour holy XML into such an impure, defiled, and unclean vessel as an X.509 certificate.
> 
>   ------------------------------------------------------------------------
> 
>    Bob Jueneman.vcfName: Bob Jueneman.vcf
>                    Type: Plain Text (text/plain)

---

From: Rich Salz <[email-masked]>
Date: Tue, 11 Sep 2001 10:10:49 -0400

How does CXER relate to the the XML Canoinicalization spec, designed as
part of XML DSIG?

I hope the answer is "the same," but I doubt it. :(
	/r$

-- 
Zolera Systems, Your Key to Online Integrity
Securing Web services: XML, SOAP, Dig-sig, Encryption
http://www.zolera.com

---

From: Rich Salz <[email-masked]>
Date: Tue, 11 Sep 2001 18:16:44 -0400

I don't know what CXER is, but my point is that the W3C already defined
a canonical XML format.  It would be nice if there weren't two.
	/r$

-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com

---

From: Phil Griffin <[email-masked]>
Date: Tue, 11 Sep 2001 18:02:17 -0400

Rich,

CXER can be related to signing canonical XML
encodings of ASN.1 values. It has not been
targeted at all to the workings of XMLDSIG.

But a canonical encoding of an ASN.1 value
can be carried easily in an ASN.1 value, say
an attribute or extension using

Payload ::= 
   OCTET STRING (CONTAINING UTF8String 
                    ENCODED BY xml)

where "xml" is an object identifier. There are
many other useful variants that can be processed
by XML-aware ASN.1 tools.

Phil Griffin