Subject: RE: Straw Poll: SerialNumber definition

From: [email-masked]
Date: Fri, 25 Feb 2000 19:22:27 -0500

There is one point about Bengt's method which I am slightly confused
by.  Let us suppose that the normal method of putting a unique identifier
for a user into a certificate is by creating a subject alternate name with
a DN consisting of the DN of an assigning authority (most often a country,
an organization, or an organizational unit) followed by a serial number
alone in an RDN.  Does this mean that all DN's in alternate names are to be
interpreted as unique user identifiers, or only all those DN's in alternate
names whose lowest-order RDN consists solely of a serial number?  If the
latter intepretation is accepted, relatively few existing certificates
should be broken.

          Tom Gindin

---

From: Stephen Kent <[email-masked]>
Date: Mon, 28 Feb 2000 11:28:29 -0500

Tom,

My favorable reaction to this proposal is based on the assumption 
that the SubjectAltName would be a valid DN, and thus one need not 
impose any special interpretation on the use of serialNumber in that 
name.  So, for example, I would expect an name of the form: C=SE, 
O=National ID Card System, SerialNumber = 123456789.  This is 
consistent with the usual definition of the SubjectAltName extension, 
and merely suggests that this DN is an alias for the other entry in 
the DIT.

Remember, my suggestion was an effort to respond to a perceived 
special case ID requirement, which is not one of my favorite topics 
in the first place ...

Steve

---

From: Robert Malick <[email-masked]>
Date: Tue, 29 Feb 2000 14:56:39 -0500 (EST)

It seems in the discussion of placing the uniquely identifiying DN in the
SubjectAltName everyone is assuming that one needs something other than
that as the certificate subject.

Is it totally illegal or just not good practice for some reason to have a
uniquely identifying DN as a certificate subject and have the application
find other commentary attributes like displayable name (e.g., cn)
by accessing the entry in the directory for that subject DN?

For example,

Certificate Subject: sn=0001000018, o=acme, c=us

An application when looking up that DN in the directory will find:

dn: sn=0001000018, o=acme, c=us
cn: Joe Smith
...

The application can display what it likes of this particular certificate
identity. Most likely the application will access the directory for other
things for certificate path processing so I don't see this as anything out
of the ordinary.

Also, this allows one to assign identity without the overhead of
revoking certificates if these commentary attributes should change (e.g.,
cn).

Can someone tell me why it seems that one should assume that commentary
attributes must be in the subject DN of the certificate?

	Robert Malick
	National Institutes of Health