Contract No.: 285248 Strategic Objective
Download 1.78 Mb.
|
- Navigate this page:
- Revocation Authority Parameters
- Revocation Information
- Non-Revocation Evidence
14.3.3RevocationA Revocation Authority maintains information about valid and, in particular, revoked credentials. To do so, it first generates public parameters and possibly corresponding secret parameters. It publishes its public parameters together with a description of the particular revocation method that is used and a reference to the location where the most current revocation information will be published. Some revocation mechanisms require users to obtain an additional piece of information called non-revocation evidence in order to be able to prove that their credential is still valid. The different revocation mechanisms vary quite strongly in how the non-revocation evidence is created and maintained. Depending on the specific mechanism, the non-revocation evidence
The Revocation Authority can also include references to the locations where the users can obtain the information to create and to update their non-revocation evidence. Both the initialization of the non-revocation evidence and the update may be multi-leg cryptographic protocols. Revocation Authority ParametersEach Revocation Authority generates and publishes its parameters at setup. The parameters are static, i.e., they do not change over time as more credentials are revoked. /abc:RevocationAuthorityParameters This element contains the public parameters of the Revocation Authority /abc:RevocationAuthorityParameters/@Version This attribute indicates the version of this specification. The value MUST be “1.0”. /abc:RevocationAuthorityParameters/abc:ParametersUID This element contains a unique identifier for these Revocation Authority parameters. /abc:RevocationAuthorityParameters/RevocationMechanism This attribute indicates the mechanism or algorithm used to revoke credentials. The list of supported revocation mechanisms and their identifiers have not yet been defined. /abc:RevocationAuthorityParameters/abc:RevocationInfoReference This optional element contains a reference to the endpoint where the most current public revocation information corresponding to these parameters can be obtained. /abc:RevocationAuthorityParameters/abc:NonRevocationEvidenceReference This optional element contains a reference to the endpoint with the information about how to obtain the (possibly private) user-specific non-revocation evidence object. /abc:RevocationAuthorityParameters/abc:NonRevocationEvidenceUpdateReference This optional element contains a reference to the endpoint the most current information for updating the non-revocation evidence can be obtained. /abc:RevocationAuthorityParameters/abc:RevocationInfoReference/@ReferenceType This attribute indicates the type of reference to the revocation information endpoint. /abc:RevocationAuthorityParameters/abc:CryptoParams This element describes the set of public cryptographic parameters that are needed to verify the Revocation Information. The content of this element is defined in an external profile based on the value of the abc:RevocationMechanism element.
The Revocation Authority publishes the revocation information using the artifact described below. How this artifact is protected (authenticated) is application specific; e.g., it could be included in a XML-signed document or provided as part of some metadata retrievable from a trusted source. The following describes the attributes and elements listed in the schema outlined above: /abc:RevocationInformation This element contains the current revocation information, as published by the Revocation Authority. At each update of the revocation information, a new abc:RevocationInformation element is generated. /abc:RevocationInformation/@Version This attribute indicates the version of this specification. The value MUST be “1.0”. /abc:RevocationInformation/abc:InformationUID This element contains the unique identifier of the revocation information. This identifier is different for each version of the revocation information, i.e., a new URI is used at every update. /abc:RevocationInformation/abc:RevocationAuthorityUID This element contains the identifier of the parameters of the revocation authority that published the revocation information. /abc:RevocationInformation/abc:Created This optional element contains the date and time when the revocation information was updated or first published. /abc:RevocationInformation/abc:Expires This optional element contains the date and time until when the revocation information is valid. /abc:IssuerParameters/abc:CryptoParams This element describes the set of public cryptographic parameters needed to verify whether a credential is still valid. (The content of this element is defined in an external profile based on the value of the @RevocationMechanism attribute specified in the referenced abc:Revocation AuthorityParameters element) Non-Revocation EvidenceThe exact details of how and when the non-revocation evidence is created and updated vary greatly among the different revocation mechanisms. We therefore simply define an artifact that acts as a wrapper for a message in a (possibly multi-legged) evidence creation or update protocol. These messages are sent to and received as a response from the evidence creation and update endpoints specified in the Revocation Authority parameters. The following describes the attributes and elements listed in the schema outlined above: /abc:RevocationMessage/@Context This attribute contains a unique identifier for this protocol session, so that the different flows in the protocol session can be linked together. The request MUST contain a Context attribute. The revocation authority MUST reject requests with context values already in use. /abc:RevocationMessage/abc:RevocationAuthorityParametersUID This element contains the identifier of the parameters of the revocation authority that creates the non-revocation evidence information. /abc:RevocationMessage/abc:CryptoParams This element describes the mechanism-specific (cryptographic) parameters needed to obtain the non-revocation evidence information for building or updating the evidence. Download 1.78 Mb. Share with your friends:
|