Subject: RE: Attributes within PK certs?[draft-ietf-pkix-ac509prof-00.txt]

From: Peter Williams <[email-masked]>
Date: Fri, 14 May 1999 10:10:40 -0500

On Friday, May 14, 1999 8:10 AM, Sam Schaen [SMTP:[email-masked]] wrote:
> 
> I have seen at least one vendor's product that espouses very short
> validity periods for attribute certificates (e.g., 1 hour or 1 day). 
> Short enough that one is willing to accept the risk that the information
> in the certificate has changed without resorting to a certificate
> revocation process.
>

This remarkable invention should be better investigated
by PKIX using applications.  It confounds Steve's
Rule of Revocation, and addresses Internet needs
at the same time. 

One of the modes of using OCSP is that
its responses may serve as a
surrogate-certificate, with short-expiry.  UAs can 
quote the OCSP status response instead of the public key
id cert, should the (Indirect) response issuer
incorporate the public key of the referenced cert 
in the OCSP per-cert-status extension block.

At some point PKIX will need to
define the "Qualified OCSP Profile"
of course, to standardize this optional, but
standard operational model of 2459/OCSP
deployment.

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 14 May 1999 21:48:49 +0100

Peter,
comments in line,

>Rule of Revocation, and addresses Internet needs

An example of this "remarkable invention" can be studied at [http://www.mobilephones-tng.com/v100/dynamiccerts.html ]

If we are talking about on-line operations there is money to save and security
can be completely acceptable for commercial use as the attribute
certificate is typically just a few seconds old when it is used by the relying
party.

For off-line (e-mail) use, such a dynamic system may add time-stamping
as well as you could send a signed mail as an "authorized" person but could
also have lost some power [ :-( ] when the receiver opens the mail a week later.
The letter would in most cases still be regarded as valid.

<snip>

Regards
Anders Rundgren