Subject: Re: PKI/LDAP schema, the ;binary question (Was: No-op LDAP ;binary option)

From: Steve Hanna <[email-masked]>
Date: Tue, 19 Nov 2002 14:21:14 -0500

Kurt Zeilenga wrote:
>This question is viewed by the LDAPBIS chairs as being "owned" by
>PKIX WG.   Accordingly, we've asked PKIX chairs to determine whether
>the PKI community prefers to continue using "userCertificate;binary"
>or, as proposed in draft-ietf-pkix-ldap-pki-schema-00.txt, use
>"userCertificate".

I don't know exactly what decision-making process the PKIX chairs
have in mind for determining the working group's preference.
But I suppose it all comes down to discussion on the list, so
I'll comment. I encourage others with an informed opinion on this
topic to also comment on the list.

My primary concern is that things continue to work for our users,
some whom have already deployed standards-compliant clients and
servers that only support userCertificate;binary (as required by
the current standards). To maintain compatibility with this installed
base, future clients and servers must continue to use
userCertificate;binary. If servers start accepting userCertificate
as a synonym, then once the old servers are gone we can move clients
toward using userCertificate. But that will take a long time and
until then we must use userCertificate;binary.

That's my opinion, anyway. Others are welcome.

-Steve

Kurt Zeilenga wrote:
>At 07:14 AM 2002-11-18, Hallvard B Furuseth wrote:
>>Three related suggestions for the ;binary LDAP option, moved here from
>>LDAPBIS since it is the PKIX group who "owns" the ";binary" question:
>
>For clarity here, there is an outstanding question regarding
>how X.509 certificate attributes are to be requested/transferred
>in LDAP.  Namely, will "userCertificate;binary" or "userCertificate"
>be the LDAP attribute description as the protocol token to refer
>to an userCertificate attribute.  Regardless of which, the value
>transferred is presumed to be a DER encoded X.509 certificate. 
>
>This question is viewed by the LDAPBIS chairs as being "owned" by
>PKIX WG.   Accordingly, we've asked PKIX chairs to determine whether
>the PKI community prefers to continue using "userCertificate;binary"
>or, as proposed in draft-ietf-pkix-ldap-pki-schema-00.txt, use
>"userCertificate".
>
>It should be noted that while LDAPBIS has decided to remove
>;binary from the LDAP "core" technical specification, this decision
>should not be viewed as precluding PKIX from either choice.
>In particular, ;binary can be specified as an extension to LDAP
>or, if necessary, the prior decision to remove ;binary from the
>LDAP "core" technical specification can be reconsidered.
>
>Kurt, LDAPBIS co-chair
>
>