Comments to PKIX AC profile

["Pawling, John" <[e-mail]>]

All,

In a separate message, Stephen Henson reported an incompatibility between
the Attribute Certificate (AC) ASN.1 syntaxes defined in the PKIX AC Profile
for Authorization <draft-ietf-pkix-ac509prof-06.txt> and draft 2000 X.509
Recommendation (4th Edition, Draft V7, 23 Feb 2001).  
The PKIX AC Profile, Appendix B, ASN.1 module includes "DEFINITIONS EXPLICIT
TAGS ::=", but the 2000 X.509 Recommendation ASN.1 module defining the AC
syntax includes "DEFINITIONS IMPLICIT TAGS ::=".  Recommend that the PKIX AC
Profile should be changed so that the AC ASN.1 syntax is equivalent (i.e.
produces the identical ASN.1 hex encoding) to that defined in the draft 2000
X.509 Recommendation.  This could be accomplished by moving the AC syntax
definition (and component syntax definitions) from the existing Appendix B
module to a new ASN.1 module that includes "DEFINITIONS IMPLICIT TAGS ::=".
That is the strategy used in the draft 2000 X.509 Recommendation.

Also, recommend that ac509prof-06 file should be changed so that the
Clearance attribute ASN.1 syntax defined in Appendix B is equivalent to that
defined in X.501.  X.501 defines the Clearance attribute syntax using
AUTOMATIC TAGS.  The Clearance attribute syntax in the PKIX AC profile
should be changed as follows to be consistent with X.501:

Clearance ::= SEQUENCE
  {
      policyId
          [0] OBJECT IDENTIFIER,
      classList
          [1] ClassList DEFAULT {unclassified},
      securityCategories
          [2] SET OF SecurityCategory OPTIONAL
  }

===========================================
John Pawling, [e-mail]
Getronics Government Solutions, LLC
===========================================