Subject: Re: A web of directories

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 23 Feb 1999 12:14:24 -0700

As Tom pointed out and I realized independently, there are some 
technical difficulties with the execution I proposed, not the least 
of which is the fact that a SET of optional components would be 
a nightmare to implement as the root of the DIT!

If all else fails, we could include the necessary information elsewhere 
in the certificate, although I really liked the idea of including it in the DN
in order to take advantage of existing mechanisms.

We could conceivably include a single primary directory name as a top level
component of a DN, since within that directory's view of the DIT everything 
would be consistent. And if and when we evolve to a world-wide directory
that (sub)directory name might be able to serve as a schema qualification.

But I don't want to wreck the existing DIT class definitions, at
least not out of ignorance, so I will have to propose something else.

I confess that I don't recall the AAI extension, at least by that acronym.  
Can you give me a reference to it?  If it will work, I'm happy.

Bob

>>> Stephen Kent <[email-masked]> 02/23/99 10:04AM >>>
Bob,

Aw, come on now, Bob.  DN's are NOT intended to include pointers to
directory servers.  They are names within the DIT.  Don't try to shoehorn
other info into a DN just because the GeneralName form allows other forms
of IDs.  I agree with the suggestion that one could use the AAI extension
with an appropriate sub-type.  (Actually, a previous version of PKIX Part
1, which allowed for end-entity info rather than CA info makes more sense
here, but we seemd to have lost that distinction along the way.)

Steve

---

From: Francois Rousseau <[email-masked]>
Date: Wed, 24 Feb 1999 09:03:46 -0500

Bob,

As I have previously suggested as solution to your requirement, I think
Steve meant the Authority Information Access (AIA) extension from section
4.2.2.1 of RFC 2459, which may be included in subject or CA certificates.

This proposed sub-type (i.e. id-ad-repository) would be included in
subject's certificates and could be used to associate an Internet style
identity for the location of the repository to retrieve the issuer's
certificate in cases where such a location is not related to the issuer's
name.

Francois Rousseau
AEPOS Technologies

Bob Jueneman wrote:
[clip]