Subject: RE: Cert comparison needs AI?

From: Anders Rundgren <[email-masked]>
Date: Tue, 15 Feb 2000 14:05:12 +0100

J D,

>But isn't it the responsibility of the certificate issuing authority to
>ensure two qualified certificates never refer to the same physical entity?

It definitely should, but apparently the concept of unmistakable identity has different
meaning to different people.  As unmistakable identity is the core of Qualified Certificates
it is really sad that so little has been done to penetrate this area.

IMO QC-03 guarantees that the limited interoperability offered by current PKI solutions (*) is preserved.

(*) Lotus Notes do not accept any X509 certificates except its own according to a recent
study by Swedish Police Authorities

(*) Win2K kerberos authentication only accepts its own X509 certificates according to
a well-known PKI evangelist in another mailing list

Anders

---

From: Alfred Arsenault <[email-masked]>
Date: Tue, 15 Feb 2000 08:27:38 -0500

<Anders Rundgren wrote:>

<snip>

IMO QC-03 guarantees that the limited interoperability offered by current
PKI solutions (*) is preserved.

(*) Lotus Notes do not accept any X509 certificates except its own according
to a recent
study by Swedish Police Authorities

(*) Win2K kerberos authentication only accepts its own X509 certificates
according to
a well-known PKI evangelist in another mailing list

Anders

AWA:  It's a bit harsh to blame these things on the QC draft.  If vendors
want their applications to only accept certain certificates and to reject
certificates issued by "competitors" or "those who haven't signed the right
'partnering agreement'", there's nothing we're going to do about it in PKIX.
That's a market-driven issue, and it will always be possible for application
developers to make this so.

			Al Arsenault

-- As usual, my own opinions; may or may not resemble anything my employer
is doing; etc.

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 16 Feb 2000 04:56:40 (NZDT)

Alfred Arsenault <[email-masked]> quoted Anders Rundgren:

>to a recent study by Swedish Police Authorities

Is this for v4 or v5?  Given that v5 does S/MIME (or claims to, I've never 
used it), it'd be impressive if they could do that without handling anyone 
elses certificates.

[As a side-note, given Sweden's discovery (three years after everyone else 
 knew about it :-) of Notes' differential-workfactor crypto, I'm surprised 
 they're still using it at all]

Peter.