Re: operational protocols

[Patrick Richard <[e-mail]>]

On Tue, 8 Apr 1997, Stef Hoeben wrote:

> you). So (only) authentication (by the CA) of _all_ 
> answers the Directory gives are a solution to this
> spoofing, IMHO again.

Authenticated LDAP (via TLS or your choice of auth mechanism) solves the 
issue that you are describing. In the case of LDAP over SSL, a client 
only needs to accept a single root cert (the issuer of the directory 
server's cert), and can then accept (depending on policy) the remaining 
necessary compenents/information (including _other_ root certs) via the 
directory service.

Any information retreived in this fashion can only be trusted as much as 
the directory server is trusted (and in most cases, probably less).

For all of the requirements of PKIX part II, all of the information 
provided by the directory is already signed, so this really doesn't have 
anything to do with part II. It _does_ have implications if the use of 
LDAP as an OCSP is what you are talking about.

> > 			 Cheers, Stef > 

--
Pat Richard    /    [e-mail]
---
Public Key available via LDAP
   http://www.xcert.com