Subject: Re: Low-fat leaf certificates

From: "Bob Jueneman" <[email-masked]>
Date: Fri, 02 Apr 1999 15:18:56 -0700

Just an observation.

"Low fat leaf" (LFL) certificates may make great sense if the "fat contents"
are available for trusted lookup , say in a directory.

However, it is much more likely that the "fat" content is back in the originator's 
directory, rather than the relying party's directory.

That being the case, it probably takes a lot less bandwidth, and certainly less 
latency time, to go ahead and include the information in the certificate
itself, rather then fire up LDAP to the other directory to fetch it.

Obviously this depends on how often the information is needed.  If you 
are likely to need it often, you ought to pay the burden once, and then
cache it locally in the RP directory.

Assuming the infrastructure exists to do it either way, this becomes an 
engineering tradeoff.  The same is true for sending certificates over the 
wire repeatedly, as in SSL and S/MIME, rather than normally retrieving
them from the local cache or directory or going back to the originator
as required.

Bob

>>> Peter Sylvester <[email-masked]> 03/31/99 06:49AM >>>
> 
> 1)  "Name"  (an alias/friendly name [as you are allowed to change name without changing "e"-identity])
> 
> 2) "dnQualifier"  (a static [probably random] unique identifier in the domain)
> 
> It is hard to get much slimmer than that!
> 
No, you don't need 1. 

Actually 2 is 'the name' in the sense of a unique identifier to find a directory entry.

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 08 Apr 1999 11:23:08 +0200

Anders,

Your E-mail got burried under hundred of other E-mails. Sorry for the delay to respond.

You misunderstood my talk. I am advocating against numerous extensions to certificates that could be
handled generically by "administrative" certificates that contain information valid for a large number of
leaf certificates.

So the topic you address is unrelated.

Regards,

Denis

> David,
> Just to make sure that you don't misunderstand me:
>
> I am VERY much in favor of your "Low-fat leaf certificates".
>
> That is what CyberPhone is all about.  A CyberID SUBJECT is
> supposed to consist of just two items:
>
> But a "low-fat" cert may have a "fat" cousin cert that does the dirty work in the
> rare situations that requires it.  And if they can share a common format life will
> be simpler than if all "fat" data has to be handled "out-of-band" instead of in
> nice "structured signed and certified containers of data"
>
> Regards
> Anders
> http://www.mobilephones-tng.com

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 8 Apr 1999 13:34:35 +0200

Denis,

>Your E-mail got burried under hundred of other E-mails. Sorry for the delay to respond.

Nema Problema!

>You misunderstood my talk. I am advocating against numerous extensions to >certificates that could be
>handled generically by "administrative" certificates that contain information valid for a >large number of
>leaf certificates.

Unfortunately I did not had the opportunity to attend RSA99 so I did my own 
interpretation of low-fat leaf-certificates which obviously was wrong.

No chance to get my hands on some kind of document on that?

Regards
Anders

PS Below is my version/interpretation of low-fat DS

http://www.mobilephones-tng.com/papers/idcards.html