Subject: [MSEC] Various Aspects of the Policy Token

From: Sead Muftic <[email-masked]>
Date: Tue, 26 Aug 2003 16:16:57 -0400

MSEC friends:

Wrt Policy Token I think there are three issues to be addressed:

   (1) The scope (and eventually form) of the Authorization Policy which
the token
       will represent (equivalence to the PKI Certificate Policy)
   (2) The contents of the token (in particular it should provide the
possibility
       to specify/enforce different types of policies), and
   (3) Encoding format

>    As I admitted above, my lack of familiarity with AVP may have caused 
>me to inadvertantly overlook some of its features.  Given what I have 
>seen, however, I feel that ASN.1 is much more suitable.
>

Wrt (3) I support Andrea, ASN.1 has proven to be the most suitable encoding
standard for many types
of objects in a variety of other standards. (1) and (2) may be topics for
further discussion.
The first decision, I believe, is whether we want Policy Token to be used
only by the GSAKMP
or by other (group security) protocols and second, whether we want to have
simple "Yes/No" access
to protected group resources or we need more detailed, fine-grained policy
decisions.  

Finally, many of the newest WS standards reference some type of the policy,
so I wonder (after separating
Policy Token from the GSAKMP protocol) whether we'd like to go towards more
general secure group
authorization policies or not.

Regards,

Sead Muftic
CSPRI/GWU

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec