Re: [pkix] Comments on draft-santesson-auth-context-extension-04

[Stefan Santesson <[e-mail]>]

Hi,

On the question in your mail, these mechanisms are complementary.

The semantics identifier of ETSI TS 119 412-2 may be used to give the value
of a serial number some structure.
If that is all your implementation needs, then you are al done.

In our case, it does not give us all we need, because we have:
1. Already gone through the pain of implementing identity semantics in the
form of a SAML attribute profile, and we need to leverage that also in
certs.
2. We need to map certs to SAML assertions to make sure they represent the
same user.

ETSI TS 119 412-2 does not give us that.

However, these concepts can easily be combined.

The SAML attribute value that is being placed in a serialNumber attribute
can be formatted according to the semantics identifier defined in ETSI TS
119 412-2. And the source of the identifier value may be expressed using the
auth context extension.

This way you can serve the relying party that is trained to interpret the
semantics identifier structure.
At the same time you can serve the relying party that need to know the SAML
origin of the attribute value.

The whole purpose of the extension is that the cert should work as a normal
cert even if the extension is not understood. It just provides additional
information to those trained to understand the extension.
This is the same with semantics identifier. If you don't understand that
identifier, the content of serialNumber is just understood as an arbitrary
string of characters. If you do understand it, it gives you more semantics.

/Stefan



From:  "Moudrick M. Dadashov" <[e-mail]>
Date:  Monday, March 4, 2013 11:26 AM
To:  Stefan Santesson <[e-mail]>
Cc:  Denis Pinkas <[e-mail]>, pkix <[e-mail]>
Subject:  Re: [pkix] Comments on draft-santesson-auth-context-extension-04

>     
>  
> On 3/4/2013 12:09 PM, Stefan Santesson wrote:
>  
>  
>>  
>> Denis,
>>  
>> 
>>  
>>  
>> First, thanks for your review. I really appreciate it.
>>  
>> 
>>  
>>  
>> It seems to me, especially with your leading concluding comment, that you
>> have missed out on what this specification attempts to do.
>>  
>> Perhaps you did not read the introduction enough, or perhaps I didn't write
>> it clear enough.
>>  
>> 
>>  
>>  
>> The purpose is not to associate the subject with a identifier composed of a
>> set of attributes.
>>  
>> That is, this is NOT a new name form.
>>  
>> 
>>  
>>  
>> This extension helps a relying party to understand the source of the identity
>> information that is placed in the traditional identity fields of a
>> certificate.
>>  
>> For example. If the serialNumber attributes holds the string "123456", then
>> this extension can tell you where this string came from.
>>  
>> 
>>  
>>  
>  How is this related to "semantics identifier" (ETSI TS 119 412-2) then?
>  
>  M.D.