From: John Lowry <jlowry(_at_)BBN(_dot_)COM>
To: Wolfgang Schneider <schneiw>
Cc: epg(_at_)gateway(_dot_)mitre(_dot_)org, pem-dev(_at_)TIS(_dot_)COM
Subject: Re: PEM Test Service
Sender: pem-dev-relay(_at_)TIS(_dot_)COM
Content-Length: 520
In the case that certification is being used for authorization purposes,
i.e. when you derive capabilities, access rights or whatever from authen-
ticated DNs, that certification structure is too restrictive, in my view.
It has been a while since I have followed this closely but I believe
that PEM certification implies no authorization. PEM certificates
are used by PEM solely for the purpose of authenticating identity.
Yes, correct. My remark means that I consider it to be a requirement in
the future that an organization is able to create a common certification
structure which suites for a number of different applications, one of
them being PEM, others doing authorization processes, for instance.
Wolfgang