1. Attribute Certificate By Ganesh Godavari

2. Talk About An Internet Attribute Certificate for Authorization -- RFC 3281

3. Motivation Understand Attribute Certificate How can they fit into information sharing

4. What are Attribute Certificates (AC) An AC contains no public key like PKC An AC can specify –Group Membership –Role –Security clearance –others

5. 5 When should AC be used ? PKC may include life/long lasting attributes. –if the attribute doesn’t expire before the related PKC, then the attribute may be included in the PKC. AC should be used for short lasting attributes: –if the attribute expires before the related PKC, then the attribute should placed in an AC.

6. 6 For which security services ACs may be used ? ACs may be used in the context of access control service when the identity is not the criterion that is used for access control decisions, but rather when the role or group-membership of the accessors the criterion used. role-based access control non-repudiation or data origin authentication service. the attributes contained in the AC provide additional information about the signer. This information can be used to make sure that the signer is empowered to sign the data.

7. Digital Certificates Version Serial Number Signature ID Subject Issuer Validity Period Subject Public Key Info Extensions Signature Serial Number Signature ID Holder Issuer Validity Period Attributes Extensions Signature No Public Key AC binds permission (attributes) to an entity PKC binds a subject (DN) to a public key PKC is passport and AC is visa both are complementary Public Key Certificate (PKC) Attribute Certificate (AC)

8. AC Distribution - “pull” vs. “push” AC Issuer Client Repository Server Server Lookup Client Lookup Client Acquisition Server Acquisition AC “push” ( part of app. Protocol)

9. Work need to be done Currently looking into a sample AC so that I can write it in openssl Send out request to steve of openssl group Looking again for more information into the rfc