Subject: Re: keyIdentifiers

From: "Rich Ankney" <[email-masked]>
Date: Tue, 3 Nov 1998 19:01:17 -0500

If you're referring to ANSI X9.45, it relies on uniqueness
of (issuer + serial #), rather than key identifier.

Regards,
Rich

----------
> From: Robert Moskowitz <[email-masked]>
> To: Kevin Kingdon <[email-masked]>; [email-masked]'
> Subject: RE: keyIdentifiers 
> Date: Tuesday, November 03, 1998 4:29 PM
> 
> At 12:45 PM 11/3/98 -0800, Kevin Kingdon wrote:
> >One issue that does affect applications is the scope of a key
identifier. Is
> >it unique for a given subject, a given CA, or globally unique? In other
> >words, can I build a certificate chain using just key identifiers, or do
I
> >have to use some combination of subject + identifier or issuer +
(subject)
> >identifier to build the chain? X.509 says the first case (unique only
with
> >respect to a given subject). Does PKIX expand the scope of the
identifier to
> >one of the other two levels I mentioned?
> >
> I have been in discussions where there is an ASSUMPTION that the scope is
> fairly broad, provided that the users use a different key pair for all of
> their certs.  In fact, if I remember right about one aspect of the X.9
> attribute cert doc, it puts a lot of reliance on uniqueness of
> keyIdentifer.  Now I could be remembering wrong; I can't pull the doc
right
> now, and it was not necessarily the final markup version.
> 
> 
> Robert Moskowitz
> ICSA
> Security Interest EMail: [email-masked]