I have no difficulty with affirming that v3 X.509 certificates can be used in
MIME/PEM. In fact, I take it as a given that PEM will track the X.509
standard when it comes to certificate formats. Since X.509 includes explicit
version identifiers within the certificate itself, I'd even go so far as to
view this as an implementation issue more than a standards issue.
Thanks, Amanda. In the past, this was not necessarily considered a given, in
part because of concern for stability for the process and a desire to avoid
jerking vendors around too much.
However, I
don't object to language specifically endorsing the X.509 v3 effort, if that
would be helpful.
I believe that it would be ENORMOUSLY helpful, and far beyond the PEM or
PEM/MIME arena. A significant endorsement would carry considerable weight with
those vendors and agencies who are actively engaged in the certificate
management infrastructure, including RSA, BNR, the US Postal Service, NASA,
DOE, NIST, and maybe even DOD.
Given a strong endorsement for v3, I'll do whatever I can within the NADF
community and the X.500 vendors to be sure that conformant DUAs begin to appear
as quickly as possible. (I'm sure that you understand that as a complex data
structure, adding support for a new or revised attribute like X.509 may require
coding changes, not just a revised ASN.1 spec., depending on how flexible the
implementation is.)
Warwick and I (among others) are members of an American Bar Association group
trying to grapple with all the complex legal issues associated down-the-road
applications such as international EDI and electronic commerce. The new
standard will provide a firmer foundation for those efforts.
One or two people does not constitute a concensus, of course, so I would be
particularly interested in hearing from Ned, Steve Crocker, Jim Galvin, Steve
Dusse, and other known or potential implementors. Sead Muftic and Jeff Schiller
haven't been heard from recently, and it would be nice to hear from Mike
Riordan well.
However, since some people may spend their holidays doing something other than
reading and responding to their e-mail (although they may not have been having
as much fun as we have :-), we should probably wait until after New Year's for
the rest of the group to weigh in.
Regards, Bob