Subject: Delegation of rights -- end-entity issued certs.

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 09 Jun 1999 08:36:45 -0600

I wouldn't be so hasty to reject some of Anne's and Peter's ideas 
out of hand -- they may have merit, and are at least worth some
discussion.

Internally, we've gotten some requests to use end-entity certificates 
to enable delegation of access rights to NDS, and to 
NDS access-controlled objects (partitions, attributes, and 
NetWare file system volumes), for example.

Obviously (I assume) this user-controlled delegation can't be used to
delegate Mandatory Access Control rights -- that would be a contradiction 
in terms.

But if a user has the right to delegate some or all of his Discretionary 
Access Control rights, then a certificate based system could certainly 
be used for such a purpose, and would presumably be stronger than 
yet another ID and password system, much less the more common 
approach to such problems of simply sharing passwords.

(I'm primarily thinking about authentication, not encryption at this time, 
although I suppose this might be applicable to an encrypted file system
somehow.)

At least in concept, I am willing to entertain the notion of a delegation 
certificate, perhaps in the form of an attribute cert, which says that 
"I, RRJ, hereby delegate to XYZ the ability to access so and so files
to which I have discretionary rights."

I'm NOT acting as a CA in that case -- I'm not certifying that individual's identity
at all.  I'm merely granting that person, presumably identified by someone 
else, whatever rights I choose to delegate to that person.

Bob

Robert R. Jueneman
Security Architect
Network Security Development
Novell, Inc.
122 East 1700 South
Provo, UT 84606
[email-masked]
1-801-861-7387

---

From: Ben Laurie <[email-masked]>
Date: Wed, 09 Jun 1999 18:59:17 +0100

> else, whatever rights I choose to delegate to that person.

Isn't this exactly what KeyNote (which I recently extended to cover X509
certs as entities) is for?

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi