Subject: RE: Attribute Certificate Request

From: Carlisle Adams <[email-masked]>
Date: Wed, 7 Jun 2000 15:53:00 -0400

Hi Stephen, Pedro,

> ----------
> From: 	Stephen Farrell[SMTP:[email-masked]]
> Reply To: 	[email-masked]
> Sent: 	Monday, June 05, 2000 3:46 PM
> To: 	[email-masked]
> Cc: 	[email-masked]
> Subject: 	Re: Attribute Certificate Request
> 
> Pedro,
> 
> Since the use cases for ACs aren't as well understood as for 
> public key certificates, there is, as yet, no equivalent to 
> CMP/CMC for AC requests. I would expect that, in future, we 
> might get around to writing one.
 
Actually, the future is not that far away...  :-)

The draft rfc2510bis puts in place a framework that allows CMP to be used as
a general protocol for management (including, of course, an initial request)
of any kind of certificate.  (Note that this was accomplished without
requiring any bits-on-the-wire changes to the RFC 2510 syntax.)  Formats
that have already been envisioned include attribute certificates and WTLS
certificates.  This strikes me as a very powerful and useful generalization,
and should serve to make this PKIX protocol potentially applicable to a
number of environments.

All that is required is a very short document listing the certificate types
of interest and providing a syntax for their corresponding templates.  Look
for this Internet Draft to appear shortly (within the next 2-3 weeks, I
hope).

Carlisle.

> Meanwhile, there is draft-ietf-pkix-laap-00.txt which describes
> an alternative to LDAP for AC retrieval, though this deliberately
> doesn't try to provide the equivalent of a CMP certification
> request.
> 
> Regards,
> Stephen.
> 
> Pedro Miguel Pereira Borges wrote:
> > 
> >    Hi all,
> > 
> >         I'm currently reading the "An Internet Attribute Certificate
> Profile
> > for Authorization" draft...
> >         However, there is a question that I would like to see answered:
> is
> > there a definition (ASN.1 or not) of what an attribute certificate
> request
> > should contain like there is one for the "normal" X.509 ID certificates
> ?
> > 
> >     Thanks in advance,
> > 
> >         Pedro Borges
>