Subject: RE: Delegation of rights -- end-entity issued certs.

From: Alan Lloyd <[email-masked]>
Date: Thu, 10 Jun 1999 08:33:47 +1000

snip

> I'm NOT acting as a CA in that case -- I'm not certifying that
> individual's identity
> at all.  I'm merely granting that person, presumably identified by
> someone 
> else, whatever rights I choose to delegate to that person.
	 Bob - the issue here  re "identified by someone else"  and you
are delegating rights - means that a) you trust someone else who has
done all the points of identification, and b) that they trust you  - and
you also have authority - in a certficate based system to grant
capability.. IMHO does that not make you a CA function.

	Also there is the issue of disconnection of trust by
cryptographic means - there is no reason why operationally one might
have an a system with two or more trust hierarchies - where and EE in
one relationship acts as a CA in another and that trust relationship
between the two is implied, by policy or what ever? but the question is
what is the trust, naming  and cryptographic binding between the two.

	My point is a standard defines what an EE is - in that its cert
cannot be used to verify certificate signatures 
	So if an entity generates confidentiality keys and self signs
the associated cert  - where did it get its signature key from? - and
who trusts it.

	The debate here sems to be about loosely coupling an
authentication trust hierarchy with a seperate confidentiality trust
system

	and IMHO - one should not say its a standards issue to start
with.. perhaps we need to understand the issue a bit more from a system
perspective names, trust and where the key generation for all
authentication and confidentiality services come from.

	regards alan

> Robert R. Jueneman
> Security Architect
> Network Security Development
> Novell, Inc.
> 122 East 1700 South
> Provo, UT 84606
> [email-masked]
> 1-801-861-7387