Re: [pkix] subject directory attributes extension

["Miller, Timothy J." <[e-mail]>]

> There seems to be some confusion about the use of the subject directory
> attributes extension.

Subject directory attributes is just a place to ram in random things that aren't names, policies, key usages, or otherwise fit under other extensions.  I.e., it's for things that in an X.500 directory would be represented as class attributes.  That's all.  You could put a picture of your dog in there if you like [1].  E.g., DoD PKI uses it to carry country of citizenship though I can't for the life of my name a system that processes it.

You can use it to carry attributes that you might use for access control, but that's entirely up to you and it's up to *your code* to enforce.  It's a transport convenience, not something really intended for cert validation code to muck with.  You can mark it critical, but that means you'll have a hell of a time with compatibility.  

> What is the solution: Two extensions, one for privilege attribute types and
> one for non-privilege attribute types? Seems like we have backward
> compatibility problems whatever we do.

Neither.  From an RFC perspective the current extension serves both purposes without problems.

-- T
[1] Use of this extension for as a holding pen for random data in a signature collision attack is left as an exercise for Arjen Lenstra, Marc Stevens, and Benne de Weger.  :)