Subject: RE: LDAP Certificate transfer syntax

From: "Ramsay, Ron" <[email-masked]>
Date: Thu, 4 Apr 2002 11:02:37 +1000

I thought certificate syntax was being removed from the LDAP v3 specs and,
therefore, certificate syntax was not an issue for DLAPbis?

Ron.

-----Original Message-----
From: Mark Wahl [mailto:[email-masked]]
Sent: Thursday, 4 April 2002 5:51
To: David Chadwick
Cc: Kurt D. Zeilenga; Mark C Smith; LDAP BIS; PKIX; [email-masked]
Subject: Re: LDAP Certificate transfer syntax

David Chadwick wrote:
> 
> 
> Now to the backwards compatibility issues. In the table below the only
> problem will come with a new LDAPv3 client that does not use ;binary
> with an existing v3 server that demands it. But we already have an
> inconsistency in these current LDAPv3 servers in that they accept LDAPv2
> queries without ;binary but not LDAPv3 queries without ;binary. 

I do not think LDAPv2-LDAPv3 behavior is sufficient justification to cause 
incompatibility between two LDAPv3 implementations.

Maybe an "LDAPv4" should have a different way for clients to send  
certificate, but LDAPv2 compatibility should not be a concern that causes
this significant a change inside of the LDAPv3 specs.  That is out of scope 
for LDAPBIS.

Mark Wahl
Sun Microsystems Inc.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 04 Apr 2002 09:45:08 -0800

>therefore, certificate syntax was not an issue for DLAPbis?

The LDAPbis WG is chartered specifically to revise the LDAP
"core" technical specification (RFC 2251-2256, 2829-2830).
This schema is part of that "core" specification.

The WG has decided to split the certificate schema into
separate I-Ds that can be independently progressed from
the rest of the "core" specification and to allow individuals
and/or the PKIX WG to taken on this work while LDAPbis
focuses on the rest of the "core".   As the engineering
is being done outside of LDAPbis, the engineers may consider
"new features" (something which LDAPbis cannot do).

However, LDAPbis is still responsible for the "core"
specification and should provide review for any I-D
updating the "core" specification.  This I-D will update
both RFC 2252 and RFC 2256 (if published before LDAPbis
works are published) and, hence, should be subject to
a LDAPbis WG review.

To this end, the PKIX and LDAPbis chairs have agreed that
this work be subject to a joint PKIX/LDAPbis WG Last Call.

Kurt, LDAPbis co-chair