Subject: Re: I-D ACTION:draft-ietf-pkix-usergroup-01.txt

From: Stephen Kent <[email-masked]>
Date: Mon, 28 Oct 2002 18:50:07 -0500

At 10:20 AM +0200 9/29/02, Anders Rundgren wrote:
>This is indeed an interesting topic...
>
>Essentially there are two ways to make certificates more adapted
>to their working environment:
>
>1. Clobber certificates with more "stuff" to as the draft suggests
>
>2. Use a mapping facility that maps a certificate into whatever
>     is needed by the working environment
>
>A major advantage with mapping is that you can use TTP-issued
>certificates (a.k.a. 100% outsourced PKI), and that the very same
>certificates can be used by multiple relying parties in many different
>environments.
>
>A major disadvantage with mapping is that Microsoft and probably
>most others as well, do not yet support this fundamental capability
>except to a very limited extent.  Contributing to that, is the fact that
>current PKI-standards do not offer the kind of manageble mapping
>support needed for efficient usage of TTP-issued certificates.
>
>If Microsoft and others are to upgrade their PKI support
>(which both solutions require), I really hope that they settle
>for a mapping solution.
>
>cheers,
>Anders

Another disadvantage to mapping is that it creates another 
opportunity to make errors, i.e., in mapping from the certificate 
space to the application space. the database needed to perform the 
map is an additional source of errors, or an additional attack point, 
and generally lacks the integrity afforded to certs.

Steve

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 29 Oct 2002 07:01:05 +0100

<snip>
>and generally lacks the integrity afforded to certs.

Dear Steve,

In other more established sectors of the IT-industry, the need
for mappings have been reduced by introducing globally
agreed-upon identifiers like UNSPC for product codes.
PKI is literally decades behind, where people still are fighting
about the very basics, like where to put and how to interpret identity
information, here referring to Subject DNs, SubjectAltNames,
URIs, PIs, e-mail addresses, DUNS numbers, etc.

Unless we are talking private and closed PKIs, mapping
is still a necessary evil for most systems.

cheers,
Anders

---

From: Stephen Kent <[email-masked]>
Date: Wed, 30 Oct 2002 09:50:55 -0500

>is still a necessary evil for most systems.

We have lots of options for globally unique identifiers, but none are 
globally meaningful, which is the root cause of this problem.

Could it be that focusing on a model of global, TTP PKIs creates the 
need for mapping to which you allude? If so, there there is an easy 
way to avoid this problem, right?

Steve