Subject: RE: new version of draft on additional x509 certificate schema f orLDAP

From: "Ramsay, Ron" <[email-masked]>
Date: Thu, 7 Nov 2002 18:05:03 +1100

I should think a key advantage of subordinate certificate entries is that
you may return a single certificate. If all certificates are stored in the
user's entry, you would generally receive them all on a search.

Ron.

-----Original Message-----
From: Steven Legg [mailto:[email-masked]]
Sent: Thursday, 7 November 2002 4:52 PM
To: 'Peter Gietz'; 'Housley, Russ'
Cc: [email-masked]; 'Norbert Klasen'; 'David Chadwick'
Subject: RE: new version of draft on additional x509 certificate schema
forLDAP

<snip>

Since an implementation of component matching could always use internal
data structures that mimic the metadata approach, component matching is
theoretically no worse than the metadata approach. Component matching
obviously permits greater space efficiency since it does not require the
duplication of certificates as subordinate entries, and their component
parts as additional attributes (e.g. in our server implementation the
component parts of certificates, CRLs, etc, are indexed directly).
This has a positive effect on the overall efficiency of a directory
server, but the bigger win is in the clients which are free of the burden
of managing all the explicit redundancy entailed in metadata approach.

<snip>

Regards,
Steven

---

From: "Steven Legg" <[email-masked]>
Date: Fri, 8 Nov 2002 16:24:01 +1100

Ron,

> user's entry, you would generally receive them all on a search.

David Chadwick's valuesReturnFilter control, in conjunction with
a component matching rule, enables searches that return only the
desired certificate, despite there being multiple certificate values
in entries.

Regards,
Steven