Re: Attribute Certificate Policies Extension

["Anders Rundgren" <anders.rundgren@xxxxxxxxx>]

Denis, 
I have a long time questioned the value of X.509 ACs. 
What systems and SW do you know that today supports such? 

If explicit authorizations is ever going to be a major inter-organization 
issue, it seems that authorizations will rather be transferred in various 
types of XML-formatted messages (like SAML), and that for a number 
of good reasons such as: 

- XML Schemas allow exact and easy-to-differentiate authorization
  profiles to be developed

- XML is an almost human-readable format

- XML is supported by free (or built-in) software and an abundance
   of people who knows how to use it

- Practically all vendors of the required authorization management
  SW are working with XML-based systems

This limits X.509 ACs to a few local systems of little general interest,
which makes me believe that the draft is redundant.  As policies for
internal use is implicit, and typically only can be interpreted by
humans, it does not fill a need for local enterprise systems either.

As a more constructive input, I advice you to join some of the AC-
related OASIS-groups, who at least have a chance (albeit slim), to
get their work accepted by the industry.

As indicated by others, it is maybe a good idea, to from time to time,
perform polls concerning new and existing PKIX-drafts' commercial
potential, instead of wasting energy on resurrecting a dead horse.

Just my 0.002 EUR

Anders

----- Original Message ----- 
From: "Denis Pinkas" <Denis.Pinkas@xxxxxxxx>
To: "pkix" <ietf-pkix@xxxxxxx>
Sent: Friday, October 25, 2002 15:23
Subject: Attribute Certificate Policies Extension



A new version of the draft on Attribute Certificate Policies Extension has 
been posted. It is available at :

http://www.ietf.org/internet-drafts/draft-ietf-pkix-acpolicies-extn-01.txt

Whereas the previous draft was defining different extensions, the new draft 
only covers a single extension allowing to designate the policy under which 
an Atribute Certificate has been issued.

This extension is not applicable to Public Key Certificates.

Denis