Contents 1 X.500 protocols 2 X.500 data models 3 The relationship of the X.500 Directory and X.509v3 digital certificates 4 List of X.500 series standards 5 Criticism 6 See also 7 References 8 External links

X.500 protocols[edit] The protocols defined by X.500 include DAP (Directory Access Protocol) DSP (Directory System Protocol) DISP (Directory Information Shadowing Protocol) DOP (Directory Operational Bindings Management Protocol) Because these protocols used the OSI networking stack, a number of alternatives to DAP were developed to allow Internet clients to access the X.500 Directory using the TCP/IP networking stack. The most well-known alternative to DAP is Lightweight Directory Access Protocol (LDAP). While DAP and the other X.500 protocols can now use the TCP/IP networking stack, LDAP remains a popular directory access protocol.

X.500 data models[edit] The primary concept of X.500 is that there is a single Directory Information Tree (DIT), a hierarchical organization of entries which are distributed across one or more servers, called Directory System Agents (DSA). An entry consists of a set of attributes, each attribute with one or more values. Each entry has a unique Distinguished Name, formed by combining its Relative Distinguished Name (RDN), one or more attributes of the entry itself, and the RDNs of each of the superior entries up to the root of the DIT. As LDAP implements a very similar data model to that of X.500, there is further description of the data model in the article on LDAP. X.520 and X.521 together provide a definition of a set of attributes and object classes to be used for representing people and organizations as entries in the DIT. They are one of the most widely deployed white pages schema. X.509, the portion of the standard providing for an authentication framework, is now also widely used outside of the X.500 directory protocols. It specifies a standard format for public-key certificates.

The relationship of the X.500 Directory and X.509v3 digital certificates[edit] The current use of X.509v3 certificates outside the Directory structure loaded directly into web browsers was necessary for e-commerce to develop by allowing for secure web based (SSL/TLS) communications which did not require the X.500 directory as a source of digital certificates as originally conceived in X.500 (1988). One should contrast the role of X.500 and X.509 to understand their relationship in that X.509 was designed to be the secure access method for updating X.500 before the WWW, but when web browsers became popular there needed to be a simple method of encrypting connections on the transport layer to web sites. Hence the trusted root certificates for supported certificate authorities were pre loaded into certificate storage areas on the personal computer or device. Added security is envisaged by the scheduled 2011-2014 implementation of the US National Strategy for Trusted Identities in Cyberspace, a two- to three-year project protecting digital identities in cyberspace.[2] The WWW e-commerce implementation of X.509v3 bypassed but did not replace the original ISO standard authentication mechanism of binding distinguished names in the X.500 Directory. These packages of certificates can be added or removed by the end user in their software, but are reviewed by Microsoft and Mozilla in terms of their continued trustworthiness. Should a problem arise, such as what occurred with DigiNotar, browser security experts can issue an update to mark a certificate authority as untrusted, but this is a serious removal effectively of that CA from "internet trust". X.500 offers a way to view which organization claims a specific root certificate, outside of that provided bundle. This can function as a "4 corner model of trust" adding another check to determine if a root certificate has been compromised. Rules governing the Federal Bridge policy for revoking compromised certificates are available at The contrast of this browser bundled approach is that in X.500 or LDAP the attribute "caCertificate" can be "bound" to a directory entry and checked in addition to the default pre-loaded bundle of certificates of which end users typically have never noticed unless an SSL warning message has appeared. For example, a web site using SSL, typically the DNS site name "" is verified in a browser by the software using libraries that would check to see if the certificate was signed by one of the trusted root certificates given to the user. Therefore, creating trust for users that they had reached the correct web site via HTTPS. However, stronger checks are also possible, to indicate that more than the domain name was verified. To contrast this with X.500, the certificate is one attribute of many for an entry, in which the entry could contain anything allowable by the specific Directory schema. Thus X.500 does store the digital certificate, but it is one of many attributes that could potentially verify the organization, such as physical address, a contact telephone number and an email contact. CA Certs or certificate authority certs are loaded into the browser automatically (in the case of Microsoft's update mechanism), or in new version updates of browsers, and the user is given further choices to import, delete, or develop an individual trust relationship with the loaded Certificate Authorities and determine how the browser will behave if OCSP revocation servers are unreachable. This is in contrast with the Directory model which associates the attribute caCertificate with a listed certificate authority. Thus the browser can verify the SSL cert of the website by means of the loaded group of accepted certificates or the root certificates can be looked up in an X.500 or LDAP Directory (or via HTTP/S) and imported into the list of trusted Certificate Authorities. The "bound" distinguished name is located in the subject fields of the certificate which matches the Directory entry. X.509v3 can contain other extensions depending on the community of interest other than international domain names. For broad Internet use, RFC-5280 PKIX describes a profile for fields that may be useful for applications such as encrypted email. An end user who relies on the authenticity of a certificate being presented to a browser or email has no simple way to compare a forged certificate presented (perhaps which triggers a browser warning) with a valid certificate, without also being given the opportunity to validate the DN or Distinguished Name which was designed to be looked up in an X.500 DIT. The certificate itself is public and considered to be unforgeable and can therefore be distributed in any manner, but an associated binding to an identity occurs in the Directory. Binding is what links the certificate to the identity who claims to be using that certificate. For example, the X.500 software that runs the Federal Bridge has cross certificates that enable trust between certificate authorities. Simple homographic matching of domain names has resulted in phishing attacks where a domain can appear to be legitimate, but is not. If a X.509v3 certificate is bound to a valid organization's distinguished name within the Directory, then a simple check can be made in regards to the authenticity of the certificate by a comparison with what is presented to the browser with what is present in the Directory. Some options do exist to check notaries to see if a certificate has only recently been seen, and therefore more likely to have been compromised.[3] If the cert is likely to be trusted and is failing because the domain name is a slight mismatch, it will then initially fail in the browser, but then be subjected to the notary trust, which can then bypass the browser warning. A valid organizational entry, such as o=FoobarWidgets, will also have an associated alphanumeric OID, and it has been "identity proofed" by ANSI, providing another layer of assurance regarding binding the certificate to the identity. Recent events (2011) have indicated a threat from unknown actors in nation states who have forged certificates. This was done in order to create a MITM attack against political activists in Syria accessing Facebook over the web. This would have normally triggered a browser warning, but would not if the MITM certificate was issued by a valid certificate authority already trusted by a browser or other software. Similar attacks were used by Stuxnet which allowed software to impersonate trusted code. The point of certificate transparency is to allow an end user to determine, using a simple procedure if a certificate is in fact valid. Checking against the default bundle of certificates may not be enough to do this, and therefore an additional check is desired. Other suggestions for certificate transparency have also been advanced.[4] A different attack was used against Comodo, a certificate authority, that resulted in forged certificates that were directed at high-profile communications websites. This necessitated an emergency patch to major browsers. These certificates were actually issued from a trusted Certificate Authority, and therefore a user would have had no warning if they had gone to a faked website, in contrast with the Syria incident, where the certificate was crudely forged, including substituting Alto Palo, for Palo Alto. and incorrect serial numbers. Some projects designed to exchange PHI, protected Health Information (which is considered to be highly HIPAA sensitive) may obtain X.509v3 certs via a CERT DNS resource record, or via LDAP to a X.500[2008] Directory. The issue of an authoritative bind then is detailed in RFCs related to the accuracy of the DNS information secured by signing from the root using DNSSEC. The concept of root name servers has been a source of major contention in the Internet community, but for DNS is largely resolved. The name space associated with X.500 has traditionally been thought to start with a national naming authority, which mirrors the ISO/ITU approach to global systems with national representation. Thus different countries will create their own unique X.500 services. The U.S. X.500 was privatized in 1998, when the U.S. Government no longer offered X.500 or DNS registration outside of known government agencies. The X.500 pilot project has been in development in the commercial space, and the technology continues to be present in major installations of millions of users within corporate data centers, and within the U.S. Government for credentialing.

List of X.500 series standards[edit] ITU-T number ISO/IEC number Title of Standard X.500 ISO/IEC 9594-1 The Directory: Overview of concepts, models and services X.501 ISO/IEC 9594-2 The Directory: Models X.509 ISO/IEC 9594-8 The Directory: Public-key and attribute certificate frameworks X.511 ISO/IEC 9594-3 The Directory: Abstract service definition X.518 ISO/IEC 9594-4 The Directory: Procedures for distributed operation X.519 ISO/IEC 9594-5 The Directory: Protocol specifications X.520 ISO/IEC 9594-6 The Directory: Selected attribute types X.521 ISO/IEC 9594-7 The Directory: Selected object classes X.525 ISO/IEC 9594-9 The Directory: Replication X.530 ISO/IEC 9594-10 The Directory: Use of systems management for administration of the Directory

Criticism[edit] The authors of RFC 2693 (concerning SPKI) note that "The original X.500 plan is unlikely ever to come to fruition. Collections of directory entries... are considered valuable or even confidential by those owning the lists and are not likely to be released to the world in the form of an X.500 directory sub-tree." and that "The X.500 idea of a distinguished name (a single, globally unique name that everyone could use when referring to an entity) is also not likely to occur." "X.500 is too complex to support on desktops and over the Internet, so LDAP was created to provide this service 'for the rest of us'."[5]

See also[edit] ISO/IEC JTC 1/SC 6

References[edit] ^ ^ "National Strategy for Trusted Identities in Cyberspace".  ^ Wendlandt, Dan; Andersen, David G.; Perrig, Adrian (June 2008). "Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing" (PDF). Proceedings of the 2008 USENIX Annual Technical Conference: 321–334.  ^ [1] ^ What is LDAP?. Retrieved on 2013-07-17.

External links[edit] Chadwick, D W (1994). "Understanding X.500 - The Directory". Retrieved 2017-12-06. The X.500 community site that is both a guide to the X.500 Standard and a repository for existing and new work being carried out on the standard. v t e ISO standards by standard number List of ISO standards / ISO romanizations / IEC standards 1–9999 1 2 3 4 5 6 7 9 16 31 -0 -1 -2 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 128 216 217 226 228 233 259 269 302 306 428 518 519 639 -1 -2 -3 -5 -6 646 690 732 764 843 898 965 1000 1004 1007 1073-1 1413 1538 1745 1989 2014 2015 2022 2047 2108 2145 2146 2240 2281 2709 2711 2788 2848 2852 3029 3103 3166 -1 -2 -3 3297 3307 3602 3864 3901 3977 4031 4157 4217 4909 5218 5428 5775 5776 5800 5964 6166 6344 6346 6385 6425 6429 6438 6523 6709 7001 7002 7098 7185 7200 7498 7736 7810 7811 7812 7813 7816 8000 8178 8217 8571 8583 8601 8632 8652 8691 8807 8820-5 8859 -1 -2 -3 -4 -5 -6 -7 -8 -8-I -9 -10 -11 -12 -13 -14 -15 -16 8879 9000/9001 9075 9126 9293 9241 9362 9407 9506 9529 9564 9594 9660 9897 9899 9945 9984 9985 9995 10000–19999 10005 10006 10007 10116 10118-3 10160 10161 10165 10179 10206 10218 10303 -11 -21 -22 -28 -238 10383 10487 10585 10589 10646 10664 10746 10861 10957 10962 10967 11073 11170 11179 11404 11544 11783 11784 11785 11801 11898 11940 (-2) 11941 11941 (TR) 11992 12006 12182 12207 12234-2 13211 -1 -2 13216 13250 13399 13406-2 13450 13485 13490 13567 13568 13584 13616 14000 14031 14224 14289 14396 14443 14496 -2 -3 -6 -10 -11 -12 -14 -17 -20 14644 14649 14651 14698 14750 14764 14882 14971 15022 15189 15288 15291 15292 15398 15408 15444 -3 15445 15438 15504 15511 15686 15693 15706 -2 15707 15897 15919 15924 15926 15926 WIP 15930 16023 16262 16612-2 16750 16949 (TS) 17024 17025 17100 17203 17369 17442 17799 18000 18004 18014 18245 18629 18916 19005 19011 19092 (-1 -2) 19114 19115 19125 19136 19439 19500 19501 19502 19503 19505 19506 19507 19508 19509 19510 19600:2014 19752 19757 19770 19775-1 19794-5 19831 20000+ 20000 20022 20121 20400 21000 21047 21500 21827:2002 22000 23270 23271 23360 24517 24613 24617 24707 25178 25964 26000 26300 26324 27000 series 27000 27001 27002 27006 27729 28000 29110 29148 29199-2 29500 30170 31000 32000 38500 40500 42010 55000 80000 -1 -2 -3 Category Authority control GND: 4239992-0 Retrieved from "" Categories: OSI protocolsISO standardsITU-T recommendationsApplication layer protocolsDirectory servicesHidden categories: Wikipedia articles with GND identifiersPages using RFC magic links

Navigation menu Personal tools Not logged inTalkContributionsCreate accountLog in Namespaces ArticleTalk Variants Views ReadEditView history More Search Navigation Main pageContentsFeatured contentCurrent eventsRandom articleDonate to WikipediaWikipedia store Interaction HelpAbout WikipediaCommunity portalRecent changesContact page Tools What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationWikidata itemCite this page Print/export Create a bookDownload as PDFPrintable version Languages CatalàČeštinaDanskDeutschEestiEspañolFrançais한국어ItalianoMagyarNederlands日本語PolskiPortuguêsРусскийSuomiУкраїнськаYorùbá中文 Edit links This page was last edited on 24 February 2018, at 21:53. Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization. Privacy policy About Wikipedia Disclaimers Contact Wikipedia Developers Cookie statement Mobile view (window.RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgPageParseReport":{"limitreport":{"cputime":"0.132","walltime":"0.182","ppvisitednodes":{"value":373,"limit":1000000},"ppgeneratednodes":{"value":0,"limit":1500000},"postexpandincludesize":{"value":39791,"limit":2097152},"templateargumentsize":{"value":180,"limit":2097152},"expansiondepth":{"value":10,"limit":40},"expensivefunctioncount":{"value":0,"limit":500},"unstrip-depth":{"value":0,"limit":20},"unstrip-size":{"value":3232,"limit":5000000},"entityaccesscount":{"value":1,"limit":400},"timingprofile":["100.00% 115.789 1 -total"," 51.36% 59.472 1 Template:Reflist"," 39.77% 46.045 2 Template:Cite_web"," 23.55% 27.269 1 Template:ISO_standards"," 22.02% 25.499 1 Template:Authority_control"," 21.73% 25.156 1 Template:Navbox"," 5.92% 6.860 1 Template:Icon"," 4.59% 5.318 1 Template:Cite_journal"," 4.25% 4.925 1 Template:Nobold"," 2.95% 3.418 1 Template:Smaller"]},"scribunto":{"limitreport-timeusage":{"value":"0.049","limit":"10.000"},"limitreport-memusage":{"value":2651105,"limit":52428800}},"cachereport":{"origin":"mw1274","timestamp":"20180316141725","ttl":1900800,"transientcontent":false}}});});(window.RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgBackendResponseTime":265,"wgHostname":"mw1274"});});

X.500 - Photos and All Basic Informations

X.500 More Links

Directory ServiceITU-TX.400International Organization For StandardizationOpen Systems InterconnectionDirectory Access ProtocolOpen Systems InterconnectionInternet Protocol SuiteLightweight Directory Access ProtocolDirectory Information TreeDirectory System AgentDistinguished NameRelative Distinguished NameLightweight Directory Access ProtocolX.520White Pages SchemaX.509Web BrowserNational Strategy For Trusted Identities In CyberspaceDigiNotarMan-in-the-middle AttackHealth Insurance Portability And Accountability ActISO/IECX.509SPKILDAPISO/IEC JTC 1/SC 6Template:ISO StandardsTemplate Talk:ISO StandardsInternational Organization For StandardizationList Of International Organization For Standardization StandardsList Of ISO RomanizationsList Of IEC StandardsISO 1ISO 2Preferred NumberISO 4ISO 5ISO 6ISO 7ISO 9A440 (pitch Standard)ISO 31ISO 31-0ISO 31-1ISO 31-2ISO 31-3ISO 31-4ISO 31-5ISO 31-6ISO 31-7ISO 31-8ISO 31-9ISO 31-10ISO 31-11ISO 31-12ISO 31-13ISO 128ISO 216ISO 217ISO 226British Standard Pipe ThreadISO 233ISO 259EnvelopeKappa NumberVicat Softening PointISO 428ISO 518ISO 519ISO 639ISO 639-1ISO 639-2ISO 639-3ISO 639-5ISO 639-6ISO/IEC 646ISO 690ISO 732Antimagnetic WatchISO 843ISO 898ISO 965ISO 1000Magnetic Ink Character Recognition135 FilmOCR-A FontISO 1413ALGOL 60ISO 1745ISO 1989ISO 2014ISO 2015ISO/IEC 2022ISO 2047International Standard Book NumberISO 2145ISO 2146ISO 2240Water Resistant MarkISO 2709ISO 2711ISO 2788ISO 2848ISO 2852126 FilmISO 3103ISO 3166ISO 3166-1ISO 3166-2ISO 3166-3International Standard Serial NumberISO 3307Kunrei-shiki RomanizationISO 3864International Standard Recording CodeISO 3977ISO 4031ISO 4157ISO 4217ISO/IEC 4909ISO/IEC 5218ISO 5428ISO 5775ISO 5776ISO 5800ISO 5964ISO 6166ISO 6344ISO 6346ISO 6385Water Resistant MarkANSI Escape CodeISO 6438ISO 6523ISO 6709ISO 7001ISO 7002PinyinPascal (programming Language)ISO 7200OSI ModelISO 7736ISO/IEC 7810ISO/IEC 7811ISO/IEC 7812ISO/IEC 7813ISO/IEC 7816ISO 8000ISO 8178Fuel OilFTAMISO 8583ISO 8601Computer Graphics MetafileISO/IEC 8652ISO 8691Language Of Temporal Ordering SpecificationISO/IEC 8820-5ISO/IEC 8859ISO/IEC 8859-1ISO/IEC 8859-2ISO/IEC 8859-3ISO/IEC 8859-4ISO/IEC 8859-5ISO/IEC 8859-6ISO/IEC 8859-7ISO/IEC 8859-8ISO-8859-8-IISO/IEC 8859-9ISO/IEC 8859-10ISO/IEC 8859-11ISO/IEC 8859-12ISO/IEC 8859-13ISO/IEC 8859-14ISO/IEC 8859-15ISO/IEC 8859-16Standard Generalized Markup LanguageISO 9000SQLISO/IEC 9126File Allocation TableISO 9241ISO 9362Shoe SizeManufacturing Message SpecificationISO 9529ISO 9564ISO 9660ISO 9897C (programming Language)POSIXISO 9984ISO 9985ISO/IEC 9995ISO 10005ISO 10006ISO 10007ISO/IEC 10116Whirlpool (cryptography)ISO 10160ISO 10161Guidelines For The Definition Of Managed ObjectsDocument Style Semantics And Specification LanguageISO 10206ISO 10218ISO 10303EXPRESS (data Modeling Language)ISO 10303-21ISO 10303-22ISO 10303-28STEP-NCISO 10383ISO 10487ArmSCIIIS-ISUniversal Coded Character SetTorxRM-ODPMultibusInternational Standard Music NumberISO 10962ISO/IEC 10967ISO/IEEE 11073ISO 11170ISO/IEC 11179ISO/IEC 11404JBIGISO 11783ISO 11784 & 11785ISO 11784 & 11785ISO/IEC 11801ISO 11898ISO 11940ISO 11940-2ISO/TR 11941ISO/TR 11941ISO 11992ISO 12006ISO/IEC TR 12182ISO/IEC 12207Tag Image File Format / Electronic PhotographyPrologPrologPrologIsofixTopic MapsISO 13399ISO 13406-2110 FilmISO 13485ISO 13490ISO 13567Z NotationISO 13584International Bank Account NumberISO 14000ISO 14031ISO 14224PDF/UAHorsepowerISO/IEC 14443MPEG-4MPEG-4 Part 2MPEG-4 Part 3Delivery Multimedia Integration FrameworkH.264/MPEG-4 AVCMPEG-4 Part 11MPEG-4 Part 12MPEG-4 Part 14MPEG-4 Part 14MPEG-4 Part 14ISO 14644STEP-NCISO 14651ISO 14698ISO 14750Software MaintenanceC++ISO 14971ISO 15022ISO 15189ISO/IEC 15288Ada Semantic Interface SpecificationISO 15292ISO 15398Common CriteriaJPEG 2000Motion JPEG 2000HTMLPDF417ISO/IEC 15504International Standard Identifier For Libraries And Related OrganizationsISO 15686ISO/IEC 15693International Standard Audiovisual NumberISO 15706-2International Standard Musical Work CodeISO 15897ISO 15919ISO 15924ISO 15926ISO 15926 WIPPDF/XMaxiCodeECMAScriptPDF/VTISO 16750ISO/TS 16949ISO/IEC 17024ISO/IEC 17025ISO 17100:2015Open Virtualization FormatSDMXLegal Entity IdentifierISO/IEC 27002ISO/IEC 18000QR CodeISO/IEC 18014ISO 18245Process Specification LanguagePhotographic Activity TestPDF/AISO 19011ISO 19092-1ISO 19092-2ISO 19114ISO 19115Simple Feature AccessISO 19136ISO 19439Common Object Request Broker ArchitectureUnified Modeling LanguageMeta-Object FacilityXML Metadata InterchangeUnified Modeling LanguageKnowledge Discovery MetamodelObject Constraint LanguageMeta-Object FacilityXML Metadata InterchangeBusiness Process Model And NotationISO 19600:2014ISO/IEC 19752RELAX NGISO/IEC 19770X3DISO/IEC 19794-5Cloud Infrastructure Management InterfaceISO/IEC 20000ISO 20022ISO 20121ISO 20400MPEG-21International Standard Text CodeISO 21500ISO/IEC 21827ISO 22000C Sharp (programming Language)Common Language InfrastructureLinux Standard BasePDF/ELexical Markup FrameworkISO-TimeMLCommon LogicISO 25178ISO 25964ISO 26000OpenDocumentDigital Object IdentifierISO/IEC 27000-seriesISO/IEC 27000ISO/IEC 27001ISO/IEC 27002ISO/IEC 27006International Standard Name IdentifierISO 28000ISO 29110Requirements EngineeringJPEG XROffice Open XMLRuby (programming Language)ISO 31000Portable Document FormatISO/IEC 38500Web Content Accessibility GuidelinesISO/IEC 42010ISO 55000ISO/IEC 80000ISO 80000-1ISO 80000-2ISO 80000-3Category:ISO StandardsHelp:Authority ControlIntegrated Authority FileHelp:CategoryCategory:OSI ProtocolsCategory:ISO StandardsCategory:ITU-T RecommendationsCategory:Application Layer ProtocolsCategory:Directory ServicesCategory:Wikipedia Articles With GND IdentifiersCategory:Pages Using RFC Magic LinksDiscussion About Edits From This IP Address [n]A List Of Edits Made From This IP Address [y]View The Content Page [c]Discussion About The Content Page [t]Edit This Page [e]Visit The Main Page [z]Guides To Browsing WikipediaFeatured Content – The Best Of WikipediaFind Background Information On Current EventsLoad A Random Article [x]Guidance On How To Use And Edit WikipediaFind Out About WikipediaAbout The Project, What You Can Do, Where To Find ThingsA List Of Recent Changes In The Wiki [r]List Of All English Wikipedia Pages Containing Links To This Page [j]Recent Changes In Pages Linked From This Page [k]Upload Files [u]A List Of All Special Pages [q]Wikipedia:AboutWikipedia:General Disclaimer