Subject: Re: Attributes within PK certs? [RE: I-D ACTION:draft-ietf-pkix-ac509prof-00.txt]

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 11 May 1999 08:22:14 +0100

John,
I would be less pessimistic on the adoption of ACs as they solve things that public key certificates never will.

If you look on ( http://www.mobilephones-tng.com/v100/dynamiccerts.html ) you will find a scheme for a MAJOR APPLICATION that ALONE could move ACs forward based on pure commercial needs.

Regards
Anders Rundgren
Senior Internet e-commerce Architect

>I'd like to welcome this work to PKIX's scope, and to make a general comment
>relevant to the draft. I believe that attribute certification will be
>valuable and important in broadening the scope of PKI technologies to span
>authorization as well as authentication.  If experience is a guide, however,
>new certification infrastructures can take a long time to become
>established.  With this in mind, I suggest that we decouple the idea of
>certifying authorization attributes from the idea that they must be in ACs
>separate from public-key identity certificates.  As [XPDAM] allows, I
>suggest that PKIX-profiled authorization attributes alternatively be
>representable within subjectDirectoryAttributes of a public-key certificate,
>when CA and AA responsibilities and validity periods overlap appropriately.
>This would imply some change to 2459's description of this attribute (which
>says that it may be used in local environments, but is not recommended as an
>essential part of the 2459 profile), but would allow authorization
>attributes to be incorporated incrementally within CAs' certificates rather
>than necessitating a separate infrastructure. 
>
>--jl
>