RE: Use of attribute certificates in SignedData

["Christopher S. Francis" <chris.francis@xxxxxxxxxxxxxxxx>]

Thanks Russ.  That confirms my interpretation of 2630.  I'm concerned that
if I include an AC in SignedData in the "correct" field that commonly
available applications/toolkits will choke when they try to validate the
signature on the SignedData object.

I was hoping for a solution in which AC-enabled applications would use the
AC if one is provided, but commonly available "AC challenged"
applications/toolkits would just ignore it and rely only on the PKC for
signature validation.  Based on some of the responses I got from the SMIME
list, it sounds like I may not be able to achieve this; especially since I
would prefer to use the X.509 2000 AC syntax.

Chris
-----Original Message-----
From: Housley, Russ [mailto:rhousley@xxxxxxxxxxxxxxx]
Sent: Wednesday, August 29, 2001 10:24 AM
To: Christopher S. Francis
Cc: Ietf-Pkix
Subject: Re: Use of attribute certificates in SignedData

Chris:

SignedData has the following syntax:

       SignedData ::= SEQUENCE {
         version CMSVersion,
         digestAlgorithms DigestAlgorithmIdentifiers,
         encapContentInfo EncapsulatedContentInfo,
         certificates [0] IMPLICIT CertificateSet OPTIONAL,
         crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
         signerInfos SignerInfos }

       CertificateSet ::= SET OF CertificateChoices

       CertificateChoices ::= CHOICE {
         certificate Certificate,                               -- See X.509
         extendedCertificate [0] IMPLICIT ExtendedCertificate,  -- Obsolete
         v1AttrCert [1] IMPLICIT AttributeCertificateV1,        -- Obsolete
         v2AttrCert [2] IMPLICIT AttributeCertificateV2 }       -- See X.509


PKCs and ACs needed to process any of the signerInfos should be carried in
the certificates field.

Russ

At 10:43 AM 8/28/2001 -0400, Christopher S. Francis wrote:

>I have a question for the group concerning attribute certificates.
>
>
>
>Is there an accepted location to put an attribute certificate associated
>with the signer in the SignedData data structure?  I have a SignedData
>object and I m considering putting an attribute certificate associated
>with the signer in the certificates field of SignedData in addition to the
>PKC of the signer.
>
>Is that a philosophically correct location?  Other options include burying
>the certificate in the encapsulated content or including it as a Signed or
>UnSigned attribute.
>
>
>
>I d appreciate any advice and or lessons learned that you can
>offer.  Thanks in advance.
>
>
>
>Chris Francis
>
>