Subject: Re: which usercertificate attribute

From: Russ Housley <[email-masked]>
Date: Thu, 06 Apr 2000 11:43:21 -0400

Thierry:

 > When I use Netscape Communicator as a mail client, I can 'get' the 
certificates of my correspondents from a ldap directory.
 > Netscape however looks for a userSMIMEcertificate instead of a 
userCertificate.
 >
 > Which is the correct attribute to publish Certificates in ?
 > I would think that using 1 certificate for all applications would be a 
lot more user friendly.

See draft-ietf-smime-certdist-04.txt for a description of 
userSMimeCertificate.  I think the document does a good job explaining why 
userSMimeCertificate and userCertificate both exist.

Russ

---

From: "Blake Ramsdell" <[email-masked]>
Date: Fri, 7 Apr 2000 12:03:19 -0700

This sounds reasonable.

I presume that there's going to be a round of edits surrounding a magic date
in September...

Blake

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]]
Sent: Friday, April 07, 2000 10:22 AM
To: [email-masked]
Subject: Re: which usercertificate attribute

The correct attribute in which to publish end-entity certificates is
the one defined by RFC 2587 "LDAPv2 Schema", namely userCertificate.

RFC 2632 "S/MIME Version 3 Certificate Handling", section 4, does not
specify user agent requirements, leaving implementors on their own to
decide how to retrieve certs.  It mentions X.500 (presumably meaning
DAP) and DNS, but says:

  "At a minimum, for initial S/MIME deployment, a user agent
  could automatically generate a message to an intended recipient
  requesting that recipient's certificate in a signed return
  message."

For son-of-2632, the first paragraph of section 4 needs to be rewritten
to reflect the current directory environment.  At that time, it should
also provide a little more guidance on interoperability.  I suggest:

  "At a minimum, S/MIME user agents MUST support LDAP (RFC 2559) and
  the LDAP v2 Schema (RFC 2587)."

The new section 4 could mention certdist as an option, but standard
LDAP should be mandatory.  Certdist could (if modified) be used to
communicate the recipient's algorithm preferences without containing
the recipient's certificate(s).

Dave Kemp

> From: [email-masked] (Terry Hayes)
> 
> Thierry Van Doninck wrote:
> 
> > Hi,
> >
userCertificate.
> > I would think that using 1 certificate for all applications would be a
lot 
more user friendly.
> >
> 
> The userSMIMEcertificate attribute contains additional information about
the 
SMIME recipient, in particular the preferred
> encryption algorithms.  Without this information, the message sender has
to 
guess what algorithms would be acceptable.  This is
> why Communicator used userSMIMEcertificate.
> 
> More recent versions of SMIME support for Communicator (in particular the
PSM 
security add-on) supports retrieval of the
> certificates from both attributes in the directory.  In addition, PSM has 
support for automatically retrieving certificates
> from your primary directory (address book) without manual intervention.
> 
> Terry Hayes
> [email-masked]

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 8 Apr 2000 09:34:23 (NZST)

"David P. Kemp" <[email-masked]> writes:

>The new section 4 could mention certdist as an option, but standard LDAP 
>should be mandatory.  

Why should it be mandatory?  I can see that saying that finding a cert is
a good idea, but mandating it is not (there will always be situations where
it doesn't make sense), and mandating one particular way of doing it is even
worse - even if you are in a situation where retrieving a cert is useful,
being forced to do it via LDAP is an unnecessary restriction.

Peter.

---

From: "Bob Jueneman" <[email-masked]>
Date: Sat, 08 Apr 2000 23:06:19 -0600

Peter,

At the risk of putting words in David's mouth, I think he was trying to define a 
mandatory minimum environment that compliant software could be assumed 
to support, so as to help ensure interoperability.

That certainly shouldn't preclude retrieving certificates some other way, of 
course.

Bob

>>> Peter Gutmann <[email-masked]> 04/08/00 09:34AM >>>

Peter.

---

From: "David P. Kemp" <[email-masked]>
Date: Mon, 10 Apr 2000 08:46:00 -0400 (EDT)

Peter,

Bob put the right words in my mouth :-).  IETF specifications use
"MUST", "SHOULD", and "MAY" in a uniform manner to enhance the
ability to interoperate.  MUST always means "must implement",
not "must use".

But I meant mandatory in an even more limited sense:  *if* applications
are going to support LDAP (i.e. X.500 directory attributes) to retrieve
certs, then they MUST be able to do it in accordance with the 
standard LDAP schema.

Dave