Re: Request for comments from x500 experts

[[e-mail]]

>For Public Switching Telecommunication Networks,
>We are studying an architecture to offer several services to customers
>in a multi providers environment. We would have liked to use an implementation
>conformed to ITU-T Recommendation X500 series to ensure and support
>the security of the services but it seems that we have to define
>our own X500 extensions. Before, to select this kind of alternative, 

Why not use X.509 signatures? The Directory can store the certificates
using standardised attributes, and each entry can have its associated
public-secret key-pair and certificate. Then, any entity with access
to the Directory can validate any user by sending them a challenge
to be encrypted under the user's secret key. If the response can be
decrypted with the public key shown in the certificate, and if the
certificate itself has an acceptable signature then the user must be
genuine.

Existing smart-card chips are capable of doing public-key crypto at an
acceptable speed for most requirements, and can be made to hold the
secret key and process the validation.

Andrew

----------------------------------------------------------------------------
|      From Andrew Findlay at Brunel University, Uxbridge, UB8 3PH, UK     |
| [e-mail]     [phone] or [phone] x2512 |
----------------------------------------------------------------------------