Subject: [pkix] Revised Submission: claimSigning EKU draft for PKIX WG Consideration

From: Matt King <[email-masked]>
Date: Fri, 28 Oct 2011 12:53:42 -0400

Dear PKIX Working Group

I have posted an updated draft document describing the claimSigning
EKU.  It is titled “draft-king-pkix-claimsigning-extn-02.txt”
(abstract below) and it can be found at the following link for your
review:

http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1

This revised draft replaces "draft-king-pkix-claimsigning-extn-01.txt".

I ask that the attached draft be considered as a new work item for
this group.  Thank you in advance for your time.

Matt
--
Matt King
Protiviti Inc.
Government Services
[email-masked]
[email-masked]
410-271-5624 (Mobile)

On Wed, May 25, 2011 at 3:36 PM, Matt King <[email-masked]> wrote:
> Dear PKIX Working Group
>
> I have posted an updated draft document describing the claimSigning EKU.  It is
> titled “draft-king-pkix-claimsigning-extn-01.txt” (abstract below) and
> it can be found at the following link for your review:
>
> http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1
>
> This revised draft replaces both the initial draft
> "draft-king-pkix-claimsigning-extn-00.txt"
> and "draft-patterson-pkix-attribute-signing-eku".  The authors of both
> drafts have
> collaborated and addressed all comments received to date and are
> moving forward with this single submission.
>
> I ask that the attached draft be considered as a new work item for
> this group.  Thank you in advance for your time.
>
> Matt
> --
> Matt King
> Protiviti Inc.
> Government Services
> [email-masked]
> [email-masked]
> 410-271-5624 (Mobile)
>
>
> Abstract
>
>   This memo specifies an Extended Key Usage (EKU) X.509 certificate
>   extension which indicates that the certificate holder is authorized
>   to sign security tokens to assert claims, or attributes, about a
>   principal.
>
>   When an owner of a certificate that asserts the claimSigning EKU
>   signs a claim, the owner is asserting that a statement about the
>   principal is true. For example, a IdP secure token service (STS)
>   would use an X.509 certificate containing the claimSigning EKU to
>   sign SAML assertions containing an identifier and attributes about a
>   user. This additional EKU value would further allow the
>   differentiation of certificates used to identify a particular server
>   from those used by the server to sign identity or attribute claims.
>
>
>
>
> On Fri, Apr 22, 2011 at 1:51 PM, Matt King <[email-masked]> wrote:
>> Dear PKIX Working Group
>>
>> I have posted an draft document describing a claimSigning EKU.  It is
>> titled “draft-king-pkix-claimsigning-extn-00.txt” (abstract below) and
>> it can be found at the following link for your review:
>>
>> http://datatracker.ietf.org/doc/draft-king-pkix-claimsigning-extn/?include_text=1
>>
>> I ask that the attached draft be considered as a new work item for
>> this group.  Thank you in advance for your time.
>>
>> Abstract
>>
>>   This memo specifies an Extended Key Usage (EKU) X.509 certificate
>>   extension which indicates that the certificate holder is authorized
>>   to sign security tokens to assert claims, or attributes, about a
>>   principal.
>>
>>   When an owner of a certificate that asserts the claimSigning EKU
>>   signs a claim, the owner is asserting that a statement about the
>>   principal is true. For example, a IdP secure token service (STS)
>>   would use an X.509 certificate containing the claimSigning EKU to
>>   sign SAML assertions containing an identifier and attributes about a
>>   user.
>>
>>
>> --
>> Matt King
>> Protiviti
>> Government Services
>> [email-masked]
>> [email-masked]
>> 410-271-5624 (Mobile)
>>
>
>
>
> --
> Matt King
> [email-masked]
> 410-271-5624 (Mobile)
>

-- 
Matt King
[email-masked]
410-271-5624 (Mobile)