Subject: Re: SEIS: Regarding "Given names"

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 17 Mar 1999 10:48:05 -0700

I agree that would be possible, to issue multiple certificates and to put
appropriate ID information into each certificate, although it may lead 
to an enormous proliferation of certificates -- one for each unique 
application, at worst.  (Of course if you sell certificates, the more the merrier! :-)

But with respect to the "additional security problems associated with
directories," I was not referring to directories operated by some 
independent third-party, but to enterprise directories that are operated
by the same people that administer the various applications.

If I authenticate a user using one primary certificate, and then look 
up additional names forms and/or other attributes in the enterprise directory,
that association can certainly be as trusted as the applications themselves,
as they are probably managed by the same sets of people.

For that matter, the same basic sets of people are probably operating the 
RA functions that are used to issue the certificates as well.

Bob

>>> Stephen Kent <[email-masked]> 03/17/99 07:43AM >>>
Bob,

>You have introduced yet another degree of freedom into to this complex
>equation.  I had been sufficiently puzzled how to manage the mapping
>between a certificate and one or more directories, i.e., the Subscriber or
>Subject's directory (presumably one operated by his employer, or possibly
>his Internet Service Provider, or maybe some government agency or third
>party); the CA's directory (or maybe some third party repository), and the
>various Relying parties directories. But now you have introduced another
>level of complexity in wanting to map directly to customer databases,
>access control lists, patient records, etc.
>
>I think this may be way too much to deal with.  Instead, those application
>should refer to the directories to look up that additional information as
>required for their purposes.

Or, we can issue multiple certificates and put appropriate ID info in each.
That way we don't embrace all of the additional security problems
associated with directories.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Sun, 21 Mar 1999 15:43:45 -0500

Bob,

>application, at worst.  (Of course if you sell certificates, the more the

well,  we sell CAs to enterprises without a per-cert charge, so I ought not
be accused of bias on that basis :-).  However, we are also in the service
business, ...

>by the same people that administer the various applications.

My security concerns are more technical and largely applicable even if an
enterprise is operating the directory for itself.  Security problems
abound, IMHO, because of the complexity of the directory application, the
need to grant varying degree of online access, the use of OS platforms with
demonstrablyt poor security, etc.

>as they are probably managed by the same sets of people.

Not necssarily.  Poor security at the directory could undermine better
security for apps that rely on it, depending on how ine uses the directory.
A signed CRL is pretty safe even in a not-so-secure directoryt.  But if
someone suggests using a directory attribute to verify certificate status,
rather than performing the validation process, then things have gotten a
lot worse.

>RA functions that are used to issue the certificates as well.

It depends.  In some cases one distributes the RA functions throughout an
organization, but centralizes (or outsources) the CA function. Those who
operate the directory may be yet another set of people.

Steve

---

From: Juergen Walter <[email-masked]>
Date: Wed, 24 Mar 1999 12:53:37 +0100

Bob Jueneman wrote:
> appropriate ID information into each certificate,

X.509 proposes DN or certID. Any other proposals?

> although it may lead

I am not a CA service provider :-) but one long vehicle certificate
containing all attributes is even cost-intensive. If one attribute
changes then you will need a new certificate. The more attributes are
included the higher the possibility of a certificate update. Certificate
management expenses are necessary in addition. 

> RA functions that are used to issue the certificates as well.

This is a policy issue on the one hand and a PKI design issue on the
other hand. I think the main ideas has been already discussed on this
list. Nevertheless I would like to note that a CA service provider
should not warrants for all attributes. Attribute certificates may be a
scheme for delegating responsibility by delegating signing.

[snip]

--------------------------------------------------------------------
Juergen Walter                  
DEH information systems GmbH    WWW: http://www.deh.de
Weissenfelser Strasse 46a       Germany
D-06217 Merseburg               Tel.: +49 3461 3318-25
Email: [email-masked]            Fax:  +49 3461 415072
--------------------------------------------------------------------