Subject: Stupid Q. re. PKCs and Directories

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 13 Nov 1999 10:33:50 -0000

Hi, 
This is a spin-off  of the dnQualifier/static identity discussion.
Pardon the somewhat naive question.  

To put information in tree-shaped directories makes sense for organizations that
divide information in groups like departments, projects, regions etc.. 
Traditional database systems are not very flexible on this point so directories have their
place in a dynamically changing world.

BUT, what is the value of putting a lot of directory information in a public key certificate?

It would be awfully nice if someone who is fully “directory-enabled” would in practical terms
show the benefit of that compared to having a single key into a directory and let directory attributes
attached to that entity be externally inputted with variable data (department, role, access rights)
or static data  (sex, age, telephone).  Of course you can when the entity cert is first encountered read
attributes and insert them in the directory but the next time the RP sees that cert it has no reason
to do that. 

Anders Rundgren