Subject: RE: X.500, LDAP Considered harmful Was: OCSP/LDAP

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 14 Feb 2003 18:21:19 -0800

> I'm afraid I don't understand. AFAIK, LDAP/X.500/SQL all can 
> be set up to
> return a certificate given a unique email. Is the issue that
> companies/organizations do not set up their LDAP/X.500/SQL 
> data stores to
> allow this?

You can go rabbit hunting with a howitzer, but that does not make
it the best choice.

The point is that you do not need anything more than exact match
and in fact you will not have anything else available in the internet
case. So you do better with a system that is designed for that and 
that alone.

> So how does something like XKMS solve this? Because it 
> appears that the
> issue is not just Alice getting Bob's certificate, it's how 
> does Alice get
> all the intermediate certificates (that may or may not have a 
> unique email).

XKMS does not impose a particular data model on the problem. The XKMS
service can use local knowledge of the trust topology structure to
assist finding the certification paths and can pre-calculate and cache
such paths. The directory approach forces the client to do this work
since the searches required do not conform to the restrictions of the
data model.

		Phill

---

From: Aram Perez <[email-masked]>
Date: Mon, 17 Feb 2003 07:20:33 -0800

Hallam-Baker, Phillip wrote:

[snip]
> since the searches required do not conform to the restrictions of the

It appears that XKMS is moving the problem from the client to the server,
since how does the XKMS service learn the "trust topology structure" for a
new unknown user.

Regards,
Aram