Subject: Re: Comment on AttributeCertificate draft

From: [email-masked]
Date: Mon, 4 Sep 2000 11:48:48 -0700

Stephen,

The authors of RFC 2693 went to great lengths to explain why PKCs with
Distinguished Names will not work on global scale and why multiple certificates
per user are inescapable. They specifically address the subject of
authorizations and the mapping of authorizations to key holders, a subject AC
tries to address as well. Their reasoning can be ignored but the then ACs would
suffer from caveats mentioned in the RFC above.

In my opinion, ACs should *allow* adherence to the SPKI model, being a real
global-scale model suited for the internet, not just intra-enterprise but also
inter-enterprise. In particular: local names & global identifiers (a key issue),
reduced security with AA and CA (sec. 3.1).

I do not think allowing SPKI adherence, given the simplicity of SPKI, would not
be too difficult. There is no question in my mind that it is a very powerful
model suited for the inter-net.

Regards,
Ron.

Stephen Farrell <[email-masked]> on 09/04/2000 03:08:59 AM

Please respond to [email-masked]

Sent by:  Stephen Farrell <[email-masked]>

To:   Ron Vered/HQ/3Com
cc:   [email-masked], [email-masked], [email-masked],
      [email-masked]
Subject:  Re: Comment on AttributeCertificate draft

Hi Ron,

I'd have to say that the AC work doesn't have any direct "fit"
with SPKI since its just a profile of X.509 ACs. Having said that
however, a combination of X.509 ACs and PKCs can be used to
achieve the same authorization functionality as SPKI, though
you'd still have anti-ASN.1 reasons to use SPKI if you believe
in those. So basically its another way to do the same thing,
but based on X.509 and not 5-tuples.

I'm not familiar with X9.57, so I can't comment on it.

Regards,
Stephen.

[email-masked] wrote:
>
> Stephen,
>
> How does this proposal fit (or not) with the theoretical work on SPKI (RFC
> 2693)?
> In particular, an AC does not have a public key AND a single PKC may have
> multiple ACs. Also, SPKI suggestion on the use of X9.57 to specify
authorization
> attributes in X.509v3.
> Regards,
> Ron.

--
____________________________________________________________
Stephen Farrell
Baltimore Technologies,   tel: (direct line) +353 1 647 7406
61 Fitzwilliam Lane,                    fax: +353 1 647 7499
Dublin 2.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Stephen Kent <[email-masked]>
Date: Tue, 5 Sep 2000 13:15:40 -0400

Ron,

>per user are inescapable.

There is nothing in X.509, or in the AC work that assumes a single 
cert per user. This mispercsption is helpful in supporting the SPKI 
ideas, but it is simply not true.

>  They specifically address the subject of

>Readers of this list should note that the cited RFC and the rest of 
>the SPKI documents, are experimental, not standards track.

>reduced security with AA and CA (sec. 3.1).

No. ACs are part of the PKIX WG and thus should be consistent with 
the model we have developed here.

>model suited for the inter-net.

PKIs are not simple, despite the inclusion of words to that effect 
:-).  Adding SPKI support will complicate ACs and we're not looking 
to make this a more complex standard.

Steve