Subject: Re: [pkix] claimSigning EKU draft for PKIX WG Consideration

From: Patrick Patterson <[email-masked]>
Date: Sun, 1 May 2011 18:05:47 -0400

Hi Matt:

Nor was I aware of your proposal.

If you want to work together on this, I'm all for it... from a quick look, it seems that we may be trying to accomplish the same thing.

Let's take this offline.

Best Regards,

Patrick.

On 2011-04-26, at 3:38 AM, Stefan Santesson wrote:

> Matt,
> 
> In-line.
> 
> On 11-04-26 4:20 AM, "Matt King" <[email-masked]> wrote:
> 
>> Hi Stefan
>> 
>> Thanks for your comments.  To address some of your concerns:
>> 
>> 1. We were not aware of the competing proposal and will analyze it to
>> understand and proved more information about the differences
>> 2. We will fix the wrapping issue and missing ASN.1 section
>> 3. We will evaluate the feasibility and pracicality of defining a
>> claimSigning protocol
> 
> That is not what I was suggesting. But if you feel that is desired then
> that should probably be a matter for another work group. My point is that
> different type of standards can put different requirements on EKU
> processing. A standard just defining EKU can for example not put
> requirements on clients not implementing the standard. So you need in any
> case clear up the requirements language of that section.
> 
>> 4. I'll need to consult with my team about your metadata signing
>> comment, but I do believe that someone who signs metadata is making a
>> claim that the contents of the metadata are true.  While you could
>> execute this operation with a general purpose PKI, it would have more
>> meaning if the metadata is signed with keys associated with a cert
>> asserting a claimSigning EKU.
> 
> Well, following your reasoning, all signing is claim signing. You can
> always say that you claim something in the act of signing. The term
> "Claims" however has been used lately in the industry in a much more
> defined manner. I'd say it has been used as a substitution for the term
> "Attribute" with a minor semantical twist that I never have understood,
> but in any case very close to attributes. SAML works with attributes and
> Information Cards with claims, even though they produce SAML assertions
> with attributes (identical to the claims) in the end. In the end of the
> day, the meta data catalog do not contain neither claims, nor attributes
> of subjects. It contain metadata about identity providers, service
> providers and attribute providers etc.
> 
> I think you need to clarify your use of the term claims in your document
> to do what you suggest.
> 
> 
> /Stefan
> 
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---
Patrick Patterson
President and Chief PKI Architect
Carillon Information Security Inc.
http://www.carillon.ca

tel: +1 514 485 0789
mobile: +1 514 994 8699
fax: +1 450 424 9559