RE: Rationales for CA clearance constraints

["BRUMBY, Ian" <[e-mail]>]

My comments on the topic:

 

1.	The Clearance attribute is defined in the current X.501 (2001
and v6 draft) with an OID of 2.5.4.55. RFC 3281 (as referenced by
draft-turner-caclearanceconstraints-01.txt) defines it as 2.5.1.5.55. It
refers to X.501-1993 as the source of this definition. I've dug up the
1993 standard and can't find any reference to Clearance. If Clearance
Constraints are implemented, maybe it should be clarified if it
constrains X.501 (2003) Clearance attributes, if they are present in the
certificate, or specifically doesn't constrain them.

 

2.	With regards as to whether Clearance should be held in the
Certificate or the Directory:

	a.	I've heard concern that it shouldn't be held in either.
In a Prisoner of War scenario it potentially identifies the people with
the potential to have the most knowledge.
	b.	FYI - at least one Directory vendor is using the
Clearance attribute on the Certificate that is used to bind to the
Directory to control access to the Directory.

 

Ian Brumby

BAE Systems

 

"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."