Subject: RE: X.509 Attribute Certificates extensions in PKIX Certificates?

From: Michael Crerar <[email-masked]>
Date: Tue, 16 Mar 1999 09:53:26 -0500

I haven't seen a reaction to this message and I am also interested in
the state of PKIX standards regarding attribute certificates.  Do any of
the current PKIX standards describe the format of an attribute
certificate and the role of the entity issuing attribute certificates? 
Or is the attribute certificate only a concept that has yet to be
formalized?
 
=================================== 
Michael Crerar 
Cryptographer, Diversinet Corp. 
http://www.dvnet.com/
e-mail:  [email-masked] =================================== 

-----Original Message-----
From: Zahid Ahmed [mailto:[email-masked]]
Sent: Friday, March 12, 1999 11:35 AM
To: [email-masked]
Subject: X.509 Attribute Certificates extensions in PKIX Certificates?

Is there currently any support to generate X.509 Attribute Certificates
in 
PKIX?
 
1. If not, how can we extend and/or generate such a certificate using 
PKIX for organizations/groups/roles? The thing is that an attribute
certificate 
does not have a public key associated with it. Hence, it can not, e.g., 
extend public key Certificate structure. (Or, if does, we are really 
associating a public key with a group or organization which 
is not compatible, I believe, with PKIX X.509 end-entity identity 
X.509 certs).
 
How can one create a X.509 Attribute Certificate using current PKIX?
 
2. Also, I want to be able to include multiple attribute certificate in
a 
X.509Certiifcate which is an extension of
java.security.cert.certificate. 
How can we add such an extension to X.509Certificate class?
 
Please provide recommendation of how this can be done for allowing 
groups and roles to be associated with an end-entity X.509 certificates.
I know, e.g., there will be S/MIME and SSL clients that can take
advantage 
of such additional auth information about the subject. 
 
Zahid Ahmed                     Commerce One, Inc.
Commerce Security Architect
email: [email-masked]
v: (650)-623-2814
fax: (650)-938-8055

---

From: Francois Rousseau <[email-masked]>
Date: Tue, 16 Mar 1999 13:10:00 -0500

The only mention of Attribute Certificates in PKIX standards that I am
aware is at the end of Section 2 of PKIX Part 1 (RFC 2459) where is
indicated that:

   As supplemental authorization and attribute management tools emerge,
   such as attribute certificates, it may be appropriate to limit the
   authenticated attributes that are included in a certificate.  These
   other management tools may provide more appropriate methods of
   conveying many authenticated attributes.

The current PKIX standards do not define the format of an Attribute
Certificate and the role of the entity issuing Attribute Certificates. Work
is still ongoing under the ISO Directory Group (i.e. PDAM 1 to X.509(97))
to define Attribute Certificate's extensions. These extensions will be
necessary to control the delegation of privileges contained in Attribute
Certificates.

Current PKIX standards will need to be expanded to support Attribute
Certificates. For example, the template for a certificate content request
(i.e. CertTemplate), which is defined in CRMF (RFC 2511), is not meant for
Attribute Certificates since the owner and subject fields of an Attribute
Certificate have a different syntax than in a public-key certificate. In
addition, the CertTemplate does not contain a field to request attributes
that will contained in an Attribute Certificate, although these could be
added under a new control type in the CertRequest.

Francois Rousseau
AEPOS Technologies