[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: X.509 ACs vs. SPKI?
Terry Hayes wrote:
>
> Denis Pinkas wrote:
[snip]
> > A user may have two public key certificates with two different names but with
> > the same public key. In that case it is not always possible to know with which
> > of the two certificates the AC is associated.
>
> I believe that this is the point. The AC would be associated with the key, not
> with any specific certificate. Yes, that means there is no published expiration
> time for the key, no way to check revocation (except perhaps with the keyholder),
> and no way to associate a global name with it. The last time I checked, it was
> still possible to use key pairs without having a certificate associated with them!
> :)
>
> Validity time, and revocation services would only apply to the AC itself it this
> environment.
In SPKI, we distinguish between the terms "attribute cert" and "authorization
cert".
When I give talks on this subject, I draw a triangle whose vertices
are labeled Name, Permission and Key. (I draw it with name on top and
key on the right.)
The goal for us application developers is to map a Permission to a Key,
but we can go from left to right in two different ways.
We can take an authorization cert directly from Permission to Key or
we can take a pair of certs: attrubute cert from Permission to Name and
id cert from Name to Key.
To do that latter path, you have to identify the Name in a globally
unique way. Since there are no globally unique (ie., distinguished)
textual names and there never will be (IMHO), we choose to make
names unique by using what we call a Fully Quanlified name:
(name <key> n_1 n_2 ... n_k)
where <key> is the public key (or its hash) of a name issuer. In the
X.509 world, this is the root key of a hierarchy.
n_i are the names from that (root) key to the particular name we
care about. In X.509, this would be the names of the CAs enroute from
the root key to the leaf name. In SPKI, it's a SDSI name chain.
The two are equivalent, from the point of view of the authorization
computation.
What I was trying to say about X.509 ACs was that a form that turns it
into an authorization certificate can be interpreted unambiguously, but
if you want to use it as an attribute certificate, it's missing the ability
to specify a Fully Qualified name.
- Carl
--
Carl M. Ellison cme@alum.mit.edu http://www.pobox.com/~cme
PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2
``Officer, officer, arrest that man! He's whistling a dirty song.''
[Jean Ellison]
Follow-Ups:
References: