Subject: Re: Comments on draft-ietf-pkix-ac509prof-05.txt

From: Stephen Kent <[email-masked]>
Date: Mon, 23 Oct 2000 17:32:23 -0400

Bob,

>Steve,
>
>We have discussed this before, but unfortunately, name subordination 
>does NOT solve all of the problems, in part because of the legal 
>entanglements caused by treating wholly own subsidiary corporations, 
>Doing Business As firms, franchises, etc., as though they were 
>organization units of a larger parent organization.
>
>I got a very stern, lecture on that subject from the lawyers when I 
>was with GTE.  GTE Laboratories, Inc. is NOT an OU of GTE Corp., no 
>way no how, according to them.  And neither is GTE of Pennsylvania, 
>GTE of California, etc.

I appreciate your adherence to the advice of the lawyers for MY 
company, but we're working on an access control problem, not an NR 
problem, and I would not ask any lawyer for help in addressing 
technical issues in an access control framework.  After all, their 
assistance has been so great in the NR arena, ...

>The concern that was expressed was that to identify such 
>organizations, which are wholly owned but separate corporations, as 
>organizational units might subject the holding company to liability 
>that was incurred by the subordinate organization, which (in 
>general) is precisely the reason why separate corporations were 
>created in the first place -- to shelter the overall corporate 
>structure from lower level liabilities.

Like I said, I would not ask for their help. If we move this 
discussion to the DNS arena, we have plenty of experience, lots of 
history, and recent legal wrangling. In the case of your example, we 
have various DNS names for different parts of Verizon Communications, 
and setting up CAs aligned with the management of those DNS subtrees 
is not a bad idea.

>Granted, this approach doesn't always work -- witness the Dow 
>Corning vs. Dow Chemical breast implant suits.  But the corporate 
>attorneys I have talked to are virtually unanimous in agreeing with 
>this position, at least as long as the conventional name of the 
>attribute is "organizationalUnit".
>
>If this is the position with respect to holding companies, I have to 
>believe that it would also be the position of any CAs with competent 
>attorneys -- they are not going to allow the name of the CA to used 
>to used for such purposes either, even if the sequence of RDNs is 
>O=My CA, O=Your Corp.

I am not convinced that organizational CAs issuing certs for access 
control purposes need the help of corporate attorneys.  Did any of 
these attorneys advise us on appropriate password lengths, on the use 
of ACLs vs. capabilities, etc?

Steve

---

From: "Edward A. Feustel" <[email-masked]>
Date: Tue, 24 Oct 2000 13:43:22 -0400

I do not believe that the
proposed document: "X.509 Certificate Policy for the Federal Bridge Certification
Authority (FBCA) Version 1.06, October 23, 2000" which can be obtained through NIST PKI Office has been mentioned.

Under section 3.1.4, Uniqueness of Names:

" Name uniqueness across the FPKI (Federal Public Key Infrastructure) must
be enforced. The FBCA, Agency CAs and RAs shall enforce name uniqueness
within the X.500 name space which they have been authorized. When other
name forms are used, they too must be allocated such that name uniqueness
across the FPKI is ensured.

The FBCA and Agency CAs shall document in their respective CPSs (Certificate Practice Statements) :

What name forms shall be used,

How the FBCA,  Agency CAs and RAs will interact with the FPKIPA to ensure this is accomplished, and

How they will allocate names within the Subscriber community to guarantee
name uniqueness among current and past Subscribers (e.g., if ' Joe Smith'
leaves a CA's Community of Subscribers, and a new, different 'Joe Smith'
enters the community of Subscribers, how will these two people be provided
unique names)."

Under 3.1.5 Name claim dispute resolution procedure

" The FPKIPA shall resolve any name collisions brought to its attention that may affect interoperability using the FBCA."

Assuming this policy is signed off, if a community wants to do business with the Feds,

they will need to keep their PKI aligned with the Feds in terms of using unique names.

Ed Feustel