Subject: Attributes within PK certs? [RE: I-D ACTION:draft-ietf-pkix-ac509 prof-00.txt]

From: "Linn, John" <[email-masked]>
Date: Mon, 10 May 1999 15:34:02 -0400

I'd like to welcome this work to PKIX's scope, and to make a general comment
relevant to the draft. I believe that attribute certification will be
valuable and important in broadening the scope of PKI technologies to span
authorization as well as authentication.  If experience is a guide, however,
new certification infrastructures can take a long time to become
established.  With this in mind, I suggest that we decouple the idea of
certifying authorization attributes from the idea that they must be in ACs
separate from public-key identity certificates.  As [XPDAM] allows, I
suggest that PKIX-profiled authorization attributes alternatively be
representable within subjectDirectoryAttributes of a public-key certificate,
when CA and AA responsibilities and validity periods overlap appropriately.
This would imply some change to 2459's description of this attribute (which
says that it may be used in local environments, but is not recommended as an
essential part of the 2459 profile), but would allow authorization
attributes to be incorporated incrementally within CAs' certificates rather
than necessitating a separate infrastructure. 

--jl

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 May 1999 10:48:32 +0100

John,

Like the other responses, I guess my gut reaction would be
to try to keep authorization attributes out of public-key
certificates. As you say, there are cases where PKI and
privilege administration & validity overlap, but in our
experience this is the exception, not the typical case.
(Even where we use AC-like things to control remote access to
PKI management functionality!)

Regards,
Stephen.