Attribute Certificates and Access Management

Question

I recently came across Attribute Certificates (RFC 5755), which can be used as a means for authorisation.

I like the idea but I have spent a lot of time searching for information how this works in a real life. I understand the purpose of attribute certificates but I don't see how this can be used.

For example, I have a web application. How can I use attribute certificates for access management in web application? There must be something in the authorisation layer of a web application that can work with attribute certificates. How is this achieved? I am not able to find any examples in real web applications.

Also, are there any access management tools that supports attribute certificates, that can provide attribute certificates together with attribute authority? I can find PERMIS project but it seems to be obsolete and not useful anymore.

I would like to see real application of attribute certificates for access management not theory or possible use cases.

Answer 1

In real real life, attribute certificates don't work. Nobody really supports them. One reason for that is that certificates are, by definition, an asynchronous distribution method for information: a certificate binds some values together (for a "normal" certificate, this is a name and a public key; for an attribute certificate, the holder name is bound to the attribute values) and the binding is verifiable without talking to a central online repository. This is what the cryptographic signature on the certificate is about: to allow for offline or at least semi-offline verification.

The flip side of offline verification is that there is no way to immediately cancel a certificate. There is revocation, but it is asynchronous in nature: when a certificate is revoked, this becomes effective within a few hours or days (depending on how often CRL are produced). Asynchronism is exactly what you do not want for authorization: if you want to block somebody because of suspected malicious activity, you want to do it now, not next week.

It is possible to make synchronous revocation by making all clients obtain fresh revocation information everytime, by talking to an OCSP server, but this voids the reason why you wanted a certificate in the first place. The whole point of using certificates is to avoid having to talk to an online server every time you need some authorization information.

So, basically, certificates and authorization do not mix well. This makes RFC 5755 attribute certificates for authorization quite useless. Correspondingly, they are not much used.

Answer 2

The introduction in RFC 5755 explains the intended use for attribute certificates. I copy some text here:

Some people constantly confuse PKCs and ACs. An analogy may make the distinction clear. A PKC can be considered to be like a passport: it identifies the holder, tends to last for a long time, and should not be trivial to obtain. An AC is more like an entry visa: it is typically issued by a different authority and does not last for as long a time. As acquiring an entry visa typically requires presenting a passport, getting a visa can be a simpler process.

In a web application you would still need a PK Certificate for user authentication and Attribute Certificates would provide authorization/access management. The user would have to present both to connect to the application.

Reading RFC 5755 will reveal some other use cases. It's true that adoption has been slow and not many examples can be found by searching online, but Attribute Certificates are being used by security applications.