Subject: RE: Q: Where should do I put a max amount in a X.509v3 certificat e?

From: "Yee, Peter" <[email-masked]>
Date: Mon, 11 Mar 2002 17:03:23 -0800

Dr S N Henson wrote
>"Yee, Peter" wrote:

>> Sure, I'm glossing over the plethora of software that actually
>> supports ACs, but most of the other suggestions aren't implemented
>> either. :-)

>ACs might be more widely supported if a few public examples of them
>and their usage existed. I had a long search a while ago and couldn't
>find a single sample.

Working on it.  You didn't think I posted my attribute certificate drafts
for fun, did you. :-)

						-Peter Yee
						[email-masked]

---

From: "Yee, Peter" <[email-masked]>
Date: Fri, 8 Mar 2002 11:45:51 -0800

Tim suggests using a policy qualifier, private extension, or
subject directory attribute.  (And OCSP, with which I really have
to disagree respectfully).  I'll offer another alternative: attribute
certificates.  These seem to be a natural fit and were suggested for
just such a purpose.

						-Peter Yee
						[email-masked]

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 11 Mar 2002 12:17:29 -0800

Tom, all:

Perhaps the following design principle is well understood but in
the context of this thread I think it bears repeating.  Namely,
the more authorization type attributes bound into a PK cert, the
more likely that PK cert will be revoked prior to its
expiration.  Hence ACs.

Mike

---

From: "Tom Gindin" <[email-masked]>
Date: Mon, 11 Mar 2002 07:32:48 -0500

Peter:

      Since this "purchase limit" is intended as a constraint on signed
orders, and those are signed by PKC's rather than AC's, the constraint
needs to go into the PKC.  I also don't think the syntax is very complex
(currency designator and amount - the only choice you need to make is
whether to encode amount as Numeric String, Integer, or Real).
PolicyQualifier would make the most sense if it weren't for the conflict
between the existing use of criticality in CertificatePolicies and its use
for this feature.  If PolicyQualifiers are to remain deprecated for uses
like these, IMHO the only places for these to go are a new extension or
SubjectAltName OTHER-NAME, and it really isn't a naming attribute.
      Does profiling a new extension in new-part1 make sense?

            Tom Gindin

"Yee, Peter" <[email-masked]>@mail.imc.org on 03/08/2002 02:45:51 PM

Sent by:    [email-masked]

To:    "'Tim Polk'" <[email-masked]>, Roberto Opazo Gazmuri
       <[email-masked]>
cc:    "PKIX (Grupo de la IETF)" <[email-masked]>
Subject:    RE: Q: Where should do I put a max amount in a X.509v3
       certificat e?

-Peter Yee

[email-masked]