Subject: RE: Unsettled topics, Qualified Certificates.

From: Anders Rundgren <[email-masked]>
Date: Thu, 27 May 1999 15:47:25 +0200

Hi Petra,

>in general I like the idea of attribute certificates but they are 
>quite difficult to handle.
>How do you assure that the certificate holder will send the respective
>attribute certificate along which contains the maximum value per 
>transaction? He could only send his signature certificate or a totally
>different attribute certificate and the recipient won't know that
>there is another attribute certificate containing a maximum value per
>transaction.

I think the problem is because you talk about an unspecified transaction format.

In real life transaction formats are very specific (like PKC+AC with defined content) regardless if they
are purely local or global like SET.

So it is really a question what the potential users/deployers of such a solution would like to have.

As you may have noted [ :-) ] I am much in favor of the idea that TTPs make simple ID-only-certs while
information unrelated to the subject (transaction limits) or volatile (employment) should come from other places
through ACs or dynamic credentials.

Anders