Subject: RE: Comments on draft-ietf-pkix-ac509prof-05.txt

From: "David P. Kemp" <[email-masked]>
Date: Wed, 18 Oct 2000 18:15:32 -0400 (EDT)

It's happened before, when organizations with isolated IP networks
decided to connect to the Internet.  It was a royal pain to get a block
of official IP addresses and renumber all your machines, but it was
necessary, so people did it.  (This was before NAT and masquerading,
of course.)

At some point, organizations with isolated PKIs might decide to get an
"official" DN subtree and issue certificates within it.  After an
organization makes a decision to operate in a coordinated way with
other organizations, implementation of name constraints in cross certs
and replacement of user certificates is not particularly daunting.
Less daunting than IP renumbering, at any rate.

"Compliance" is not the problem.  The problem is understanding that an
Inter-PKI cannot really work if users pick their own DNs any more than
the Internet could work if users picked their own IP addresses.

Dave

> From: Polar Humenn <[email-masked]>
> 
> But this condition of operation for the AA still hinges on the fact that
> the DN space MUST be unique after cross certifying PKI's.
> 
> Can you really see that happening?
> 
> I cannot see that happening in the real world. Especially with many
> players, and especally when you need to do things quickly. Forcing one
> organization or both to comply with the other, is a lot of work, and
> figuring out name constraints for both could be a daunting effort, not
> mentioning getting it correct.
> 
> Cheers,
> -Polar

---

From: Ed Gerck <[email-masked]>
Date: Fri, 20 Oct 2000 06:38:12 -0700

[trimming CC list]

Dave:

As we know, PKI DNs are quite arbitrary when compared with IP numbers, which
are constants in routers and are further defined by a physical topology.  PKI DNs are
also quite arbitrary when compared with DNS names, which are in turn also quite
arbitrary when compared with IPs. So, DNS names are fully  independent from the IP
addresses used and PKI DNs have no relationship whatsoever with any of them.

Thus, I find the argument to change DNs not so compelling as with changing  IP
addresses. Any organization can and should be able to change its PKI DNs without
worrying about the needs of the network layer!

We should ask the question whether  this WG is not creating artificial constraints on
names simply because a bad name model is used and not how can we justify the bad
name model used.  It is OK IMO for this WG to use a bad name model but it is not
OK for this WG to raise this choice to the level of a "requirement."

Cheers,

Ed Gerck