Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking into using the X.509 for mutual delegation where mutual delegation is bi-directional where an entity can only delegate a task or a set of permissions to another entity if the latter is also permitted to delegate back a different task or set of permissions to the first entity

the above is a theoretical secarino where i am trying to create a protocol to solve

this protocol is entirely theoretical but i would like to make it as real world as possible

it is for a school project

i have drawn a rough sketch of what i think is a possible solution, would a protocol like the one below work ? if not what issues would it have ?

Thanks

enter image description here

Also if the above example is ok, what message would A have to send to the server to state it has roles to delegate to B etc

Anyone ?

share|improve this question
    
The SSL/TLS protocol allows for mutual authentication. An application using this protocol could delegate tasks using the x509 cert as an identity. –  Rook Oct 27 '13 at 19:01
    
Hi there, could you please elaborate on your comment, as it sounds like what i am trying to achieve thanks –  user2061913 Oct 27 '13 at 22:10
add comment

1 Answer

It is possible to establish an SSL/TLS connection with mutual authentication. In an x509 client certificate the Common Name could be a username for access control.

share|improve this answer
    
Thanks, i have authentication first via SSL to achieve mutual authentication, how would this be then used to check both can delegate tasks and then sign the x509 certif –  user2061913 Oct 28 '13 at 22:18
    
@user2061913 you need a PKI for that. OpenPKI is an example. –  Rook Oct 28 '13 at 22:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.