Subject: Re: Attributes within PK certs? [draft-ietf-pkix-ac509prof-00.txt]

From: Russ Housley <[email-masked]>
Date: Wed, 12 May 1999 11:25:36 -0400

John:

Steve Kent's Rule of Revocation: "The effective lifetime of a certificate
is inversely proportional to the square of the number of attributes."

I agree with Steve's rule. While the subjectDirectoryAttribute extension
trick allows for early deployment, it will reduce the effective lifetime of
X.509 identity certificate.  It increases the likelihood that revocation
will be necessary.

I do not think that the PKIX AC Profile should encourage the use of the
subjectDirectoryAttribute extension trick.  Nor do I think that the PKIX AC
Profile should discourage people from using it in the near term.  I think
the PKIX AC Profile should be silent on this point.

Russ

At 03:34 PM 5/10/99 -0400, Linn, John wrote:
>I'd like to welcome this work to PKIX's scope, and to make a general comment
>relevant to the draft. I believe that attribute certification will be
>valuable and important in broadening the scope of PKI technologies to span
>authorization as well as authentication.  If experience is a guide, however,
>new certification infrastructures can take a long time to become
>established.  With this in mind, I suggest that we decouple the idea of
>certifying authorization attributes from the idea that they must be in ACs
>separate from public-key identity certificates.  As [XPDAM] allows, I
>suggest that PKIX-profiled authorization attributes alternatively be
>representable within subjectDirectoryAttributes of a public-key certificate,
>when CA and AA responsibilities and validity periods overlap appropriately.
>This would imply some change to 2459's description of this attribute (which
>says that it may be used in local environments, but is not recommended as an
>essential part of the 2459 profile), but would allow authorization
>attributes to be incorporated incrementally within CAs' certificates rather
>than necessitating a separate infrastructure. 
>
>--jl

---

From: Sam Schaen <[email-masked]>
Date: Fri, 14 May 1999 09:09:59 -0400

In  the DOD PKI, the process of registering for and receiving a
certificate is fairly expensive, since a face-to-face visual
identification of the individual by a registration authority or other
trusted person is required.  (This is expensive because the potential is
for 2.5 million users spread around the world, thus requiring a large
infrastructure.)

On the other hand, we do permit the use of the stable (identity)
certificate to be used for various purposes, including authentication
for obtaining other certificates.  Currently, we only implement using
the identity certificate to obtain an S/MIME certificate.

However, that concept could be extended to other types of certificates,
including attribute certificates.  Since the cost for successive
certificates is relatively inexpensive (because it is entirely
electronic and does not require the face-to-face identification), it may
be acceptable to have certificates that do not have a long effective
lifetime.

I have seen at least one vendor's product that espouses very short
validity periods for attribute certificates (e.g., 1 hour or 1 day). 
Short enough that one is willing to accept the risk that the information
in the certificate has changed without resorting to a certificate
revocation process.

If we can agree that attribute certificates will be an adjunct to a more
stable certificate, we can then begin to debate whether the format of
the certificate should be a complete X.509 certificate with additional
extensions or a special attribute certificate that is cryptographically
bound to the identity certificate.

One also needs to consider who will be issuing attribute certificates. 
In many cases, one would want the owner of a particular resource to be
able to grant access to that resource.  That may not be the same
organization that can best validate the identity of the user.  So it may
be prudent to allow for the identity and attribute certificates to be
issued by different authorities.

Sam Schaen
MITRE Corporation