Subject: QC "Certificate Overloading"

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 9 May 1999 05:51:16 +0100

There have been comments in this list that it is convenient to use certificates for storing large data objects like biometric templates but that this is "overloading the mechanism".  I disagree as you should always go for convenient solutions if they do not have serious drawbacks.   Breaking a tradition is NOT a major drawback.  What I consider a TRUE example of certificate overloading is the QC sample certificate where statements of different origin and life-time are sharing a single certificate:

Registered by: [email-masked] 
   surname: Gloeckner
   given name: Petra
   date of birth: October, 14th 1971
   place of birth: Darmstadt
   country of citizenship: DE
   gender: female

+ (optionally)
   photo: hash+URI of photo
   signature: hash + URI of handwrittten signature

Registered by: [email-masked]
   organization: GMD
   role: project manager QC

Such a scheme probably requires you to apply for a new ID-card each time you change occupation!

For a point-by-point comparision between QC sample and the ID-solutions featured in CyberPhone take a look at the URL:

http://www.mobilephones-tng.com/miscspec/qcvscyber.html

Of course the sample is just a sample but there are signs that the sample represents what actually is in the works in some places!

Anders Rundgren
Senior Internet e-commerce Architect

---

From: "Todd S. Glassey - ELN" <[email-masked]>
Date: Sun, 9 May 1999 08:41:30 -0700

All,
Actually this thread subject, that of using x.509 certs to carry event
tokens has more higher-level implications I think. What certs were intended
for was identifying entities, not representing physical events or
timestamping data elements.

This is a very important issue and try to use a cert to carry event specific
data, while it may be technically possible, may not have as many commercial
uses as we would like to think it does, and this effect may be due to issues
in law more than anything else.Potentially, once x.509 certs become more
normalized and their standards, not only agreed upon, but deployed
ubiquitously as well, then this type of use model may be considered. In the
interim however, I think that the token format specifications will cover us
here.

The only question to answer from my perspective, is whether PKIX and the
IETF is the forum to use to standardize them and if not, then who is?

Just my two cents.

Todd Glassey

----- Original Message -----
From: Anders Rundgren <[email-masked]>
To: Denis Pinkas <[email-masked]>; Petra Gloeckner
<[email-masked]>; Stefan Santesson <[email-masked]>
Cc: <[email-masked]>
Sent: Saturday, May 08, 1999 9:51 PM
Subject: QC "Certificate Overloading"

> There have been comments in this list that it is convenient to use
certificates for storing large data objects like biometric templates but
that this is "overloading the mechanism".  I disagree as you should always
go for convenient solutions if they do not have serious drawbacks.
Breaking a tradition is NOT a major drawback.  What I consider a TRUE
example of certificate overloading is the QC sample certificate where
statements of different origin and life-time are sharing a single
certificate:
> For a point-by-point comparision between QC sample and the ID-solutions
featured in CyberPhone take a look at the URL:
> Of course the sample is just a sample but there are signs that the sample
represents what actually is in the works in some places!