X.500

X.500 is a series of computer networking standards covering electronic directory services. The X.500 series was developed by ITU-T, formerly known as CCITT, and first approved in 1988.[1] The directory services were developed in order to support the requirements of X.400 electronic mail exchange and name lookup. ISO was a partner in developing the standards, incorporating them into the Open Systems Interconnection suite of protocols. ISO/IEC 9594 is the corresponding ISO identification.

X.500 protocols

The protocols defined by X.500 include

  • DAP (Directory Access Protocol)
  • DSP (Directory System Protocol)
  • DISP (Directory Information Shadowing Protocol)
  • DOP (Directory Operational Bindings Management Protocol)

Because these protocols used the OSI networking stack, a number of alternatives to DAP were developed to allow Internet clients to access the X.500 Directory using the TCP/IP networking stack. The most well-known alternative to DAP is Lightweight Directory Access Protocol (LDAP). While DAP and the other X.500 protocols can now use the TCP/IP networking stack, LDAP remains a popular directory access protocol.

X.500 data models

The primary concept of X.500 is that there is a single Directory Information Tree (DIT), a hierarchical organization of entries which are distributed across one or more servers, called Directory System Agents (DSA). An entry consists of a set of attributes, each attribute with one or more values. Each entry has a unique Distinguished Name, formed by combining its Relative Distinguished Name (RDN), one or more attributes of the entry itself, and the RDNs of each of the superior entries up to the root of the DIT. As LDAP implements a very similar data model to that of X.500, there is further description of the data model in the article on LDAP.

X.520 and X.521 together provide a definition of a set of attributes and object classes to be used for representing people and organizations as entries in the DIT. They are one of the most widely deployed white pages schema.

X.509, the portion of the standard providing for an authentication framework, is now also widely used outside of the X.500 directory protocols. It specifies a standard format for public-key certificates.

The relationship of the X.500 Directory and X.509v3 digital certificates

The current use of X.509v3 certificates outside the Directory structure loaded directly into web browsers was necessary for e-commerce to develop by allowing for secure web based (SSL/TLS) communications which did not require the X.500 directory as a source of digital certificates as originally conceived in X.500 (1988). One should contrast the role of X.500 and X.509 to understand their relationship in that X.509 was designed to be the secure access method for updating X.500 before the WWW, but when web browsers became popular there needed to be a simple method of encrypting connections on the transport layer to web sites. Hence the trusted root certificates for supported certificate authorities were pre loaded into certificate storage areas on the personal computer or device.

Added security is envisaged by the scheduled 2011-2014 implementation of the US National Strategy for Trusted Identities in Cyberspace, a two- to three-year project protecting digital identities in cyberspace.[2]

The WWW e-commerce implementation of X.509v3 bypassed but did not replace the original ISO standard authentication mechanism of binding distinguished names in the X.500 Directory.

These packages of certificates can be added or removed by the end user in their software, but are reviewed by Microsoft and Mozilla in terms of their continued trustworthiness. Should a problem arise, such as what occurred with DigiNotar, browser security experts can issue an update to mark a certificate authority as untrusted, but this is a serious removal effectively of that CA from "internet trust". X.500 offers a way to view which organization claims a specific root certificate, outside of that provided bundle. This can function as a "4 corner model of trust" adding another check to determine if a root certificate has been compromised. Rules governing the Federal Bridge policy for revoking compromised certificates are available at www.idmanagement.gov.

The contrast of this browser bundled approach is that in X.500 or LDAP the attribute "caCertificate" can be "bound" to a directory entry and checked in addition to the default pre-loaded bundle of certificates of which end users typically have never noticed unless an SSL warning message has appeared.

For example, a web site using SSL, typically the DNS site name "www.foobar.com" is verified in a browser by the software using libraries that would check to see if the certificate was signed by one of the trusted root certificates given to the user.

Therefore, creating trust for users that they had reached the correct web site via HTTPS.

However, stronger checks are also possible, to indicate that more than the domain name was verified. To contrast this with X.500, the certificate is one attribute of many for an entry, in which the entry could contain anything allowable by the specific Directory schema. Thus X.500 does store the digital certificate, but it is one of many attributes that could potentially verify the organization, such as physical address, a contact telephone number and an email contact.

CA Certs or certificate authority certs are loaded into the browser automatically (in the case of Microsoft's update mechanism), or in new version updates of browsers, and the user is given further choices to import, delete, or develop an individual trust relationship with the loaded Certificate Authorities and determine how the browser will behave if OCSP revocation servers are unreachable.

This is in contrast with the Directory model which associates the attribute caCertificate with a listed certificate authority.

Thus the browser can verify the SSL cert of the website by means of the loaded group of accepted certificates or the root certificates can be looked up in an X.500 or LDAP Directory (or via HTTP/S) and imported into the list of trusted Certificate Authorities.

The "bound" distinguished name is located in the subject fields of the certificate which matches the Directory entry. X.509v3 can contain other extensions depending on the community of interest other than international domain names. For broad Internet use, RFC-5280 PKIX describes a profile for fields that may be useful for applications such as encrypted email.

An end user who relies on the authenticity of a certificate being presented to a browser or email has no simple way to compare a forged certificate presented (perhaps which triggers a browser warning) with a valid certificate, without also being given the opportunity to validate the DN or Distinguished Name which was designed to be looked up in an X.500 DIT.

The certificate itself is public and considered to be unforgeable and can therefore be distributed in any manner, but an associated binding to an identity occurs in the Directory. Binding is what links the certificate to the identity who claims to be using that certificate. For example, the X.500 software that runs the Federal Bridge has cross certificates that enable trust between certificate authorities.

Simple homographic matching of domain names has resulted in phishing attacks where a domain can appear to be legitimate, but is not.

If a X.509v3 certificate is bound to a valid organization's distinguished name within the Directory, then a simple check can be made in regards to the authenticity of the certificate by a comparison with what is presented to the browser with what is present in the Directory.

Some options do exist to check notaries to see if a certificate has only recently been seen, and therefore more likely to have been compromised.[3] If the cert is likely to be trusted and is failing because the domain name is a slight mismatch, it will then initially fail in the browser, but then be subjected to the notary trust, which can then bypass the browser warning.

A valid organizational entry, such as o=FoobarWidgets, will also have an associated alphanumeric OID, and it has been "identity proofed" by ANSI, providing another layer of assurance regarding binding the certificate to the identity.

Recent events (2011) have indicated a threat from unknown actors in nation states who have forged certificates. This was done in order to create a MITM attack against political activists in Syria accessing Facebook over the web. This would have normally triggered a browser warning, but would not if the MITM certificate was issued by a valid certificate authority already trusted by a browser or other software. Similar attacks were used by Stuxnet which allowed software to impersonate trusted code. The point of certificate transparency is to allow an end user to determine, using a simple procedure if a certificate is in fact valid. Checking against the default bundle of certificates may not be enough to do this, and therefore an additional check is desired. Other suggestions for certificate transparency have also been advanced.[4]

A different attack was used against Comodo, a certificate authority, that resulted in forged certificates that were directed at high-profile communications websites. This necessitated an emergency patch to major browsers. These certificates were actually issued from a trusted Certificate Authority, and therefore a user would have had no warning if they had gone to a faked website, in contrast with the Syria incident, where the certificate was crudely forged, including substituting Alto Palo, for Palo Alto. and incorrect serial numbers.

Some projects designed to exchange PHI, protected Health Information (which is considered to be highly HIPAA sensitive) may obtain X.509v3 certs via a CERT DNS resource record, or via LDAP to a X.500[2008] Directory. The issue of an authoritative bind then is detailed in RFCs related to the accuracy of the DNS information secured by signing from the root using DNSSEC.

The concept of root name servers has been a source of major contention in the Internet community, but for DNS is largely resolved. The name space associated with X.500 has traditionally been thought to start with a national naming authority, which mirrors the ISO/ITU approach to global systems with national representation. Thus different countries will create their own unique X.500 services. The U.S. X.500 was privatized in 1998, when the U.S. Government no longer offered X.500 or DNS registration outside of known government agencies.

The X.500 pilot project has been in development in the commercial space, and the technology continues to be present in major installations of millions of users within corporate data centers, and within the U.S. Government for credentialing.

List of X.500 series standards

ITU-T number ISO/IEC number Title of Standard
X.500 ISO/IEC 9594-1 The Directory: Overview of concepts, models and services
X.501 ISO/IEC 9594-2 The Directory: Models
X.509 ISO/IEC 9594-8 The Directory: Public-key and attribute certificate frameworks
X.511 ISO/IEC 9594-3 The Directory: Abstract service definition
X.518 ISO/IEC 9594-4 The Directory: Procedures for distributed operation
X.519 ISO/IEC 9594-5 The Directory: Protocol specifications
X.520 ISO/IEC 9594-6 The Directory: Selected attribute types
X.521 ISO/IEC 9594-7 The Directory: Selected object classes
X.525 ISO/IEC 9594-9 The Directory: Replication
X.530 ISO/IEC 9594-10 The Directory: Use of systems management for administration of the Directory

Criticism

The authors of RFC 2693 (concerning SPKI) note that "The original X.500 plan is unlikely ever to come to fruition. Collections of directory entries... are considered valuable or even confidential by those owning the lists and are not likely to be released to the world in the form of an X.500 directory sub-tree." and that "The X.500 idea of a distinguished name (a single, globally unique name that everyone could use when referring to an entity) is also not likely to occur."

"X.500 is too complex to support on desktops and over the Internet, so LDAP was created to provide this service 'for the rest of us'."[5]

See also

References

  1. ^ http://www.collectionscanada.gc.ca/iso/ill/document/ill_directory/X_500andLDAP.pdf
  2. ^ "National Strategy for Trusted Identities in Cyberspace".
  3. ^ Wendlandt, Dan; Andersen, David G.; Perrig, Adrian (June 2008). "Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing" (PDF). Proceedings of the 2008 USENIX Annual Technical Conference: 321–334.
  4. ^ "Certificate Transparency". www.certificate-transparency.org.
  5. ^ What is LDAP?. Gracion.com. Retrieved on 2013-07-17.

External links

Anatoly Tishchenko Sr.

Anatoliy Ivanovich Tischenko (Russian: Анато́лий Петро́вич Ти́щенко) is a Soviet sprint canoer who competed in the early 1970s. He won three medals at the ICF Canoe Sprint World Championships with two golds (K-1 500 m and K-1 4 x 500 m: both 1970) and a bronze (K-1 4 x 500 m: 1971).

Canoeing at the 1960 Summer Olympics – Men's K-1 4 × 500 metres

The men's K-1 4 × 500 metres event was a relay kayaking event conducted over 500 meters as part of the Canoeing at the 1960 Summer Olympics program on Lake Albano. This would be the only time this event was held in the Summer Olympics though it was part of the ICF Canoe Sprint World Championships from 1948 to 1975.

Csaba Giczy

Csaba Giczy (born 5 August 1945) is a Hungarian sprint canoer who competed from the late 1960s to the late 1970s. Competing in two Summer Olympics, he won two medals at Mexico City in 1968 with a silver in the K-2 1000 m and a bronze in the K-4 1000 m events.

Giczy also won eight medals at the ICF Canoe Sprint World Championships with three golds (K-1 4 x 500 m: 1971, K-4 1000 m: 1973, K-4 10000 m: 1973), three silvers (K-4 10000 m: 1971, 1974, 1977), and two bronzes (K-4 1000 m: 1970, 1974).

Directory service

In computing, directory service or name service maps the names of network resources to their respective network addresses. It is a shared information infrastructure for locating, managing, administering and organizing everyday items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers and other objects. A directory service is a critical component of a network operating system. A directory server or name server is a server which provides such a service. Each resource on the network is considered an object by the directory server. Information about a particular resource is stored as a collection of attributes associated with that resource or object.

A directory service defines a namespace for the network. The namespace is used to assign a name (unique identifier) to each of the objects. Directories typically have a set of rules determining how network resources are named and identified, which usually includes a requirement that the identifiers be unique and unambiguous. When using a directory service, a user does not have to remember the physical address of a network resource; providing a name locates the resource. Some directory services include access control provisions, limiting the availability of directory information to authorized users.

Géza Csapó

Géza Csapó (born December 29, 1950) is a Hungarian sprint canoeist who competed in the 1970s. Competing in two Summer Olympics, he won two medals in K-1 1000 m event with a silver in 1976 and a bronze in 1972.

Csapó also won eleven medals at the ICF Canoe Sprint World Championships with six golds (K-1 500 m: 1973, 1975; K-1 1000 m: 1973, 1974; K-1 4 x 500 m: 1971, K-2 10000 m: 1973), two silvers (K-1 500 m: 1973, K-1 4 x 500 m: 1973), and three bronzes (K-1 4 x 500 m: 1970, K-2 500 m: 1977, K-4 1000 m: 1971).

He was elected Hungarian Sportsman of the year in 1973 after winning three gold medals at that year's World Championships.

Haralambie Ivanov

Haralambie Ivanov (February 23, 1941 – August 22, 2004) was a Romanian sprint canoeist who competed in the mid to late 1960s. Competing in two Summer Olympics, he won a silver in the K-4 1000 m event at Mexico City in 1968. Ivanov also won six medals at the ICF Canoe Sprint World Championships with four golds (K-1 4 x 500 m: 1963, K-2 500 m: 1963, K-2 1000 m: 1963, K-4 1000 m: 1966), a silver (K-4 1000 m: 1963), and a bronze (K-1 4 x 500 m: 1966). He died in Crișan, Tulcea in 2004.

ITU T.61

T.61 is an ITU-T recommendation for a Teletex character set. T.61 predated Unicode,

and was the primary character set in ASN.1 used in early versions of X.500 and X.509

for encoding strings containing characters used in Western European languages. While T.61 continues to be supported in modern versions of X.500 and X.509, it has been deprecated in favor of Unicode. It is also called Code page 1036, CP1036, or IBM 01036.

While ASN.1 does see wide use and the T.61 character set is used on some standards using ASN.1 (for example in RSA Security's PKCS #9), the 1988-11 version of the T.61 standard itself was superseded by a never-published 1993-03 version; the 1993-03 version was withdrawn by the ITU-T. The 1988-11 version is still available.

Letter Number Punctuation Symbol Other undefined

Johan Andersen (canoeist)

Johan Frederik Kobberup Andersen (January 24, 1920 – May 7, 2003) was a Danish sprint canoeist from Aarhus who competed in the late 1940s and early 1950s. He won a silver medal in the K-1 1000 m event at the 1948 Summer Olympics in London.

Andersen also won a complete set of medals at the ICF Canoe Sprint World Championships with a gold (K-1 500 m: 1950), a silver (K-1 4 x 500 m: 1950), and a bronze (K-1 4 x 500 m: 1948).

Lars Glasser

Lars Glasser (October 4, 1925 – January 15, 1999) was a Swedish sprint canoeist who competed in the late 1940s and early 1950s. He won the silver medal in the K-2 1000 m event at the 1952 Summer Olympics in Helsinki.

Glasser also won six medals at the ICF Canoe Sprint World Championships with five golds (K-1 4 x 500 m: 1948, 1950, 1954; K-2 500 m: 1950, K-2 1000 m: 1950) and one silver (K-1 500 m: 1948). Note that the K-1 500 m, K-1 4 x 500 m, and K-2 500 m events were part of the International Canoe Federation's 1948 World Championships and not of the 1948 Summer Olympics which was also in London. The K-1 4 x 500 m event was held at the Summer Olympics once at the 1960 Games in Rome while the K-1 500 m and K-2 500 m have been held at every Olympics since the 1976 Games in Montreal.

Lightweight Directory Access Protocol

The Lightweight Directory Access Protocol (LDAP ) is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. Directory services play an important role in developing intranet and Internet applications by allowing the sharing of information about users, systems, networks, services, and applications throughout the network. As examples, directory services may provide any organized set of records, often with a hierarchical structure, such as a corporate email directory. Similarly, a telephone directory is a list of subscribers with an address and a phone number.

LDAP is specified in a series of Internet Engineering Task Force (IETF) Standard Track publications called Request for Comments (RFCs), using the description language ASN.1. The latest specification is Version 3, published as RFC 4511 (a road map to the technical specifications is provided by RFC4510).

A common use of LDAP is to provide a central place to store usernames and passwords. This allows many different applications and services to connect to the LDAP server to validate users.LDAP is based on a simpler subset of the standards contained within the X.500 standard. Because of this relationship, LDAP is sometimes called X.500-lite.

List of power stations in India

The total installed power station capacity in India as on September 30, 2018 is 344,719 MW with sector wise & type wise break up as given below.

@The break up of other renewable energy sources (RES) is: wind power (34,293.48 MW), Solar power (23,022.83 MW), Biomass power & gasification (8,700.80 MW), Small hydro (4,493.20 MW), Waste-to-energy (138.30 MW).

For the state wise allocation of the installed utility power capacity, refer to States of India by allocated power capacity.

The following lists name many of the utility power stations in India.

László Kovács (canoeist)

László Kovács is a Hungarian sprint canoeist who competed in the early 1950s. He won three medals at the ICF Canoe Sprint World Championships with a gold (K-4 1000 m: 1954) and two silvers (K-1 4 x 500 m and K-2 500 m: 1958).

Mihály Hesz

Mihály Hesz (born 15 December 1943) is a Hungarian sprint canoeist who competed from the early 1960s to the early 1970s. Competing in two Summer Olympics, he won two medals in the K-1 1000 m event with a gold in 1968 and a silver in 1964.

Hesz also won six medals at the ICF Canoe Sprint World Championships with two golds (K-1 10000 m: 1966, K-1 4 x 500 m: 1971), a silver (K-1 4 x 500 m: 1966), and three bronzes (K-1 500 m: 1971, K-1 10000 m: 1963, K-1 4 x 500 m: 1970).

He married and later divorced Andrea Gyarmati, who won two medals in women's swimming at the 1972 Summer Olympics in Munich.

Minolta X-570

The Minolta X-570 (X-500 in Europe) was introduced in 1983 as a lower cost alternative to the X-700. It used the same chassis as the rest of the Minolta X series and the standard Minolta SR mount. The primary difference between the top-of-the-line X-700 and the X-570 is that the latter lacked the fully automatic Program exposure mode. However, the X-570 added an important feature that would be part of all subsequent X series cameras, but never added to the X-700, a match LED exposure meter. This system indicated the selected shutter speed with a blinking LED and the suggested shutter speed, based on the exposure value and the selected lens aperture, with a solid LED. Some consider the X-500 more of an enthusiast's camera than the X-700, since it offered no P mode and therefore required some photographic knowledge.

Nikolay Astapkovich

Mikalai Ivanavich Astapkovich (1954 – 2000) was a Belarusian and Soviet sprint canoeist who competed in the late 1970s and early 1980s. He won eight medals at the ICF Canoe Sprint World Championships with three golds (K-2 500 m: 1975 ICF Canoe Sprint World Championships, K-2 10000 m: 1981, K-4 10000 m: 1983), four silvers (K-1 4 x 500 m: 1974, K-2 500 m: 1977, K-2 10000 m: 1979, K-4 1000 m: 1974) and a bronze (K-1 10000 m: 1982).

Ryszard Oborski

Ryszard Oborski (born May 2, 1952 in Poznań) is a Polish sprint canoer who competed from the mid-1970s to the mid-1980s. He won ten medals at the ICF Canoe Sprint World Championships with three golds (K-2 500 m: 1974, K-4 500 m: 1977, K-4 1000 m: 1977), two silvers (K-4 1000 m: 1979, K-4 10000 m: 1981), and five bronzes (K-1 4 x 500 m: 1974, K-4 500 m: 1978, 1979; K-4 10000 m: 1974, 1983).

Oborski also competed in two Summer Olympics, earning his best finish of fourth in the K-4 1000 m event at Moscow in 1980.

Sergei Chukhray

Sergei Chukhray (Russian: Чухра́й Серге́й Алексе́евич, born May 31, 1955 in Belogorsk, Amur Oblast) is a Soviet sprint canoeist who competed from the mid-1970s to the early 1980s. Competing in two Summer Olympics, he won three gold medals with one in 1976 (K-4 1000 m) and two in 1980 (K-2 500 m, K-2 1000 m).

Chukhray also won nine medals at the ICF Canoe Sprint World Championships with three golds (K-2 500 m: 1979, K-2 1000 m: 1978, K-4 10000 m: 1982), three silvers (K-1 4 x 500 m: 1974, K-4 500 m: 1979, 1983), and three bronzes (K-2 500 m: 1978, K-2 1000 m: 1979, K-4 1000 m: 1983).

Sergey Nikolskiy

Sergey Nikolskiy is a Soviet sprint canoer who competed in the mid to late 1970s. He won five medals at the ICF Canoe Sprint World Championships with four golds (K-1 4 x 500 m: 1973, K-4 10000 m: 1977, 1978, 1979), and a silver (K-4 1000 m: 1977).

Vasilie Nicoarǎ

Vasile Nicoarǎ (June 13, 1937–1978) was a Romanian sprint canoeist who competed in 1960s. He won five medals at the ICF Canoe Sprint World Championships with three golds (K-1 4 x 500 m, K-2 500 m, K-2 1000 m: all 1963), a silver (K-4 1000 m: 1963), and a bronze (K-1 4 x 500 m: 1966).

Nicoarǎ also competed in two Summer Olympics, earning his best finish of fourth in the K-2 1000 m event at Tokyo in 1964.

ISO standards by standard number
1–9999
10000–19999
20000+

This page is based on a Wikipedia article written by authors (here).
Text is available under the CC BY-SA 3.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.