Re: I-Draft on signed operations

[Steve Kille <S.Kille@isode.com>]

Vesna,

Thanks for this draft.   I believe that adding "native" signed operations to
LDAP is not worth the effort.   I think that if you want to do signed
operations, use of X.500 DAP is the right way to go.  If you REALLY
hate the OSI stack that much, an approach such as the one take in the
US Navy/NSA sldap project, which essentially used LDAP to fram DAP
PDUs is the best option.

Reasons I say this:

1) Currently LDAP and X.500 are pretty much compatible, and users can
mix them as they need.  If you introduce LDAP signed operations, this
is adding a fundamental incompatibility.

2) Because of the complexity of the ASN.1 for signing, you are going
to run into problems with LBER (this has already been pointed out).

3) This is adding a lot of ASN.1 handling.   When you have this much
ASN.1, it is easier to work with X.500 DAP than with LDAP.  


Steve Kille