RE: short-lived credential issuance

>-----Original Message-----
>From: Lawrence Greenfield [mailto:[email protected]]
>
>[snip]
>
>Yep. SACRED is tempting since you can imagine a SACRED server that
>either can sign junk certs (for temporary authentication purposes) or
>makes a long term S/MIME cert available for e-mail purposes, and does
>so in the same protocol.


Yeah, exactly.  A SACRED-supporting VPN client or web browser could retrieve
and use a cert/keypair without caring if it's a junk cert or from a PKI
repository.  Plus SACRED has the advantage over the PKIX cert-issuance
protocols, and PIC, that it delivers trusted roots in the same step.

So I'm glad nothing precludes this use, and that a CSR could be added as an
extension.  Maybe a lighterweight way of giving the client some crude input
into the junk cert would be well-known CredentialSelector names.  For
example, whether the client requests "junkSignature" or "junkAuthentication"
will determine the nonrepudiation and keyUsage bits or whatever..  Not
great, but it does help shield client software from PKI complexity.  

But that's something implementors can experiment with, and probably doesn't
need to be part of the protocol (which looks really well done, by the way,
in terms of simplicity and reuse).  Anyways, thanks for the responses.

Trevor