Subject: RE: new version of draft on additional x509 certificate schema f orLDAP

From: "Ramsay, Ron" <[email-masked]>
Date: Fri, 8 Nov 2002 16:33:03 +1100

I appreciate this. It requires engineering, though. You can get a lot of
mileage simply with schema and a tool to convert a certificate into an
entry.

-----Original Message-----
From: Steven Legg [mailto:[email-masked]]
Sent: Friday, 8 November 2002 16:24
To: Ramsay, Ron
Cc: [email-masked]
Subject: RE: new version of draft on additional x509 certificate schema
forLDAP

Ron,

Ramsay, Ron wrote:
> I should think a key advantage of subordinate certificate 
> entries is that
> you may return a single certificate. If all certificates are 
> stored in the
> user's entry, you would generally receive them all on a search.

David Chadwick's valuesReturnFilter control, in conjunction with
a component matching rule, enables searches that return only the
desired certificate, despite there being multiple certificate values
in entries.

Regards,
Steven

> -----Original Message-----
> From: Steven Legg [mailto:[email-masked]]
> Sent: Thursday, 7 November 2002 4:52 PM
> To: 'Peter Gietz'; 'Housley, Russ'
> Cc: [email-masked]; 'Norbert Klasen'; 'David Chadwick'
> Subject: RE: new version of draft on additional x509 
> certificate schema
> forLDAP
> 
> <snip>
> 
> Since an implementation of component matching could always 
> use internal
> data structures that mimic the metadata approach, component 
> matching is
> theoretically no worse than the metadata approach. Component matching
> obviously permits greater space efficiency since it does not 
> require the
> duplication of certificates as subordinate entries, and their 
> component
> parts as additional attributes (e.g. in our server implementation the
> component parts of certificates, CRLs, etc, are indexed directly).
> This has a positive effect on the overall efficiency of a directory
> server, but the bigger win is in the clients which are free 
> of the burden
> of managing all the explicit redundancy entailed in metadata approach.
> 
> <snip>
> 
> Regards,
> Steven
> 
>

---

From: Peter Gietz <[email-masked]>
Date: Fri, 08 Nov 2002 11:43:48 +0100

> mileage simply with schema and a tool to convert a certificate into an

which will be made available as Open Source fairly soon after draft 
version -02 (or pkixdraft -00).

Cheers,

Peter

-- 
_______________________________________________________________________

Peter Gietz (CEO)
DAASI International GmbH                phone: +49 7071 2970336
Wilhelmstr. 106                         Fax:   +49 7071 295114
D-72074 Tübingen                        email: [email-masked]
Germany                                 Web:   www.daasi.de

Directory Applications for Advanced Security and Information Management
_______________________________________________________________________