Subject: Attribute certificates

From: Ingo Luetkebohle <[email-masked]>
Date: Tue, 17 Jul 2001 00:20:03 +0200

Hi,

has there been discussion of specifing something like X.509 attribute
certificates for PGP? Basically, an attribute certificate is a
certification that some arbitrary association holds for the key
owner. E.g., it could be used to certify membership to some group or
to express other information about the key owner.

Regards 

-- 
	Ingo Luetkebohle / [email-masked] / 95428014
/
| Student of Computational Linguistics & Computer Science;
| Fargonauten.DE sysadmin; Gimp Registry maintainer;
| FP: 3187 4DEC 47E6 1B1E 6F4F  57D4 CD90 C164 34AD CE5B

---

From: Jon Callas <[email-masked]>
Date: Mon, 16 Jul 2001 16:10:54 -0700

>to express other information about the key owner.

Yes. The Standalone Signatures and Notation signature subpackets are
designed precisely to set up the sort of arbitrary associations that you're
looking for. But also, notations can be used other signatures to put in
information like group membership and so on.

	Jon

---

From: Ingo Luetkebohle <[email-masked]>
Date: Tue, 17 Jul 2001 10:34:21 +0200

> information like group membership and so on.

Ah, I had wondered about the notation data but wasn't sure. Thanks for
clarifiying that.

Is there any kind of 'official' registration or publishing process for
notation data to enable interoperability?

Regards

---

From: Werner Koch <[email-masked]>
Date: 18 Jul 2001 08:17:57 +0200

> notation data to enable interoperability?

2440bis has one.  Basically you append "@mydomain" to the name and
make sure that you have control over that domain. 

-- 
Werner Koch        Omnis enim res, quae dando non deficit, dum habetur
g10 Code GmbH      et non datur, nondum habetur, quomodo habenda est.
Privacy Solutions                                        -- Augustinus

---

From: Jon Callas <[email-masked]>
Date: Tue, 17 Jul 2001 23:49:42 -0700

>make sure that you have control over that domain.

Another informal alternative would be to use something similar to the Java
naming scheme. If you prefixed your attributes with : de.pages.blank@ingo,
you'd probably never run into trouble.

	Jon

---

From: Ingo Luetkebohle <[email-masked]>
Date: Wed, 18 Jul 2001 13:48:19 +0200

> make sure that you have control over that domain. 

Well, I meant a little more with 'interoperability', namely, to enable
others to implement my notations and to implement notations specified
by others. Is there some means to exchange information necessary for
that?

otherwise, thanks for the tips on how I can prevent stepping on other
software's toes :)