Subject: X.509 Attribute Certificates extensions in PKIX Certificates?

From: "Zahid Ahmed" <[email-masked]>
Date: Fri, 12 Mar 1999 08:34:49 -0800

Is there currently any support to generate X.509 Attribute Certificates in 
PKIX?
 
1. If not, how can we extend and/or generate such a certificate using 
PKIX for organizations/groups/roles? The thing is that an attribute certificate 
does not have a public key associated with it. Hence, it can not, e.g., 
extend public key Certificate structure. (Or, if does, we are really 
associating a public key with a group or organization which 
is not compatible, I believe, with PKIX X.509 end-entity identity 
X.509 certs).
 
How can one create a X.509 Attribute Certificate using current PKIX?
 
2. Also, I want to be able to include multiple attribute certificate in a 
X.509Certiifcate which is an extension of java.security.cert.certificate. 
How can we add such an extension to X.509Certificate class?
 
Please provide recommendation of how this can be done for allowing 
groups and roles to be associated with an end-entity X.509 certificates.
I know, e.g., there will be S/MIME and SSL clients that can take advantage 
of such additional auth information about the subject. 

Zahid Ahmed                     Commerce One, Inc.
Commerce Security Architect
email: [email-masked]
v: (650)-623-2814
fax: (650)-938-8055

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 17 Mar 1999 09:34:29 +0100

Michael,
Michael Crerar wrote:
I haven't seen a reaction to this message and I am also interested in
the state of PKIX standards regarding attribute certificates.  Do any of
the current PKIX standards describe the format of an attribute
certificate and the role of the entity issuing attribute certificates? 
Or is the attribute certificate only a concept that has yet to be
formalized?

I think that the closest you can get is this IETF draft:

http://www.ietf.org/internet-drafts/draft-ietf-tls-ac509prof-00.txt

A "slight" problem is how to use attribute certificates and the link below
contains a suggestion that could be applied to practically any PKI:

http://www.mobilephones-tng.com/v100/dynamiccerts.html

I would VERY MUCH APPRECIATE your (entire PKIX-list) comments to this!

Regards
Anders Rundgren
Senior Internet e-commerce Architect
Jaybis AB
+46   70 - 627 74 37
http://www.mobilephones-tng.com