Subject: Re: certificates on a URI

From: Adam Theo <[email-masked]>
Date: Thu, 21 Nov 2002 14:49:21 -0500

I am wanting to represent the entire certificate as long as it can be 
put into a single string (eg: no newlines, and other whitespace can be 
encoded). Length is not really an issue since machines will be dealing 
with this anyway, not humans, so it doesn't have to be very human friendly.

What I am trying to do is create an extensible naming scheme to address 
users on a system. every address will be comprised of "name@host", like 
an email address. So far the name part can either be the user's real 
username with their host, or it can be a pseodonym created by the host 
to anonymize the user and act as a "front" to their real account. I'm 
wanting to add a PKI certificate as a third option, so if the user 
wishes to be identified by their PKI certificate it looks like 
"certificate-hash-of-characters-here@host".

The host would not necissarily be the CA, so the information about the 
CA that created the certificate would have to be included in the "name" 
part of the address.

The different ways of naming the user (username, pseodonym, and 
certificate) will be designated by a uri namespace. for example:

user:[email-masked]
pseodo:[email-masked]
cert:G6ji3sDmfR570fGG6ji3sDmfR570fGG6ji3sDmfR570fG=[email-masked]

Hope this makes sense.

McCutcheon, Mark wrote:
> Hi Adam,
> 
> Depends on what you mean - do you want to have the entire content of the
> cert as part of a URi or just an unambiguous reference? Given that the
> public key and the signature represent the bulk of a certificate and are not
> much compressible, you really can't expect to shrink a cert significantly.
> On the other hand, RSA Keon CA indexes each certificate in its database
> using the MD5 hash of the cert (of the headerless base64 representation of a
> cert, as it happens) and that value is often used in a URi to retrieve a
> certificate or otherwise reference it. For instance, 
> 
> https://certs.r.us:443/get-cert.xuda?md5=a5a90b8f8a39673574da000f60f564af&do
> mainID=9234747711c9a2ca1f6784f4b8e56ea0d0d8ca88
> 
> is a retrieval string for a newly issued certificate from the enrollment
> server running on certs.r.us. The md5 value represents the certificate, the
> domainID represents a particular domain on the issuing CA.
> 
> Regards,
> 
> Mark McCutcheon
> 
> -----Original Message-----
> From: Adam Theo [mailto:[email-masked]]
> Sent: Wednesday, November 20, 2002 10:18 PM
> To: ietf-pkix
> Subject: certificates on a URI
> 
> 
> 
> Hi, all. I was wondering if it was possible to represent PKIX
> certificates on a single line, hopefully as part of a URI? I've not been
> able to find any answers for this question by Googling or skimming the
> most recent RFC's. Thanks.
>