Subject: Associating symmetric algorithms with a public key

From: "Trevor Freeman (Exchange)" <[email-masked]>
Date: Mon, 15 Nov 1999 16:03:10 -0800

There are a number of applications which need a hint as to the set of
symmetric algorithms which can be used with a public key from a certificate
for encrypting data with asynchronous applications. There is a directory
attribute defined in X.509 for defining supported algorithms which can list
a set of algorithms and parameters, but is not associated with any
particular key. Using this directory attribute in a certificate would seem
to solve the problem of binding a set of algorithms to a specific key.
Any objections for this to be added to son of 2459? (apart from giving Tim
yet more work - sorry Tim)
Trevor

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 16 Nov 1999 11:12:41 +0000

Trevor,

I seem to recall an objection to doing this which was raised
by Jim Schaad in the SMIME wg, can't recall exactly what it
was though, or whether it applies in general, or just to
SMIME messaging.

Regards,
Stephen.

> "Trevor Freeman (Exchange)" wrote:
> 
> There are a number of applications which need a hint as to the set of symmetric algorithms which
> can be used with a public key from a certificate for encrypting data with asynchronous
> applications. There is a directory attribute defined in X.509 for defining supported algorithms
> which can list a set of algorithms and parameters, but is not associated with any particular
> key. Using this directory attribute in a certificate would seem to solve the problem of binding a
> set of algorithms to a specific key.
> Any objections for this to be added to son of 2459? (apart from giving Tim yet more work - sorry
> Tim)
> Trevor

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 647 7406
61 Fitzwilliam Lane,                    fax: +353 1 647 7499
Dublin 2.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Paul Koning <[email-masked]>
Date: Tue, 16 Nov 1999 13:19:59 -0500

>>>>> "Exchange" == Exchange  <Trevor> writes:

 Exchange> There are a number of applications which need a hint as to
 Exchange> the set of symmetric algorithms which can be used with a
 Exchange> public key from a certificate for encrypting data with
 Exchange> asynchronous applications. 

I'm puzzled by this.  What connection is there between a public key
and a set of supported, or permitted, symmetric algorithms?  I just
don't see the relationship.

	paul

---

From: Andrew Farrell <[email-masked]>
Date: Wed, 17 Nov 1999 14:59:23 +0000

In message <[email-masked]>you 
write:

>for encrypting data with asynchronous applications. 

True, but it's also true that there may be a number of applications used
by the certificate holder, each of which has a different set of
symmetric algorithms that it supports. This attribute may be of use in
attribute certificates, but using it in a certificate ties a bit of
data (what symmetric algorithms you currently support) to a generally
orthogonal piece of data (that this is your asymmetric public key) with
a different duration.

Andrew.