Subject: RE: Any Organization Certificates out there?

From: "Pei, Mingliang" <[email-masked]>
Date: Fri, 9 Nov 2001 18:28:34 -0800

It is relatively new to add a DUNS number into certificates
by CA vendors. So it is true that few are DUNS-enabled today. 
I believe the private OID choice is due to the lack of reserved 
standard OID for DUNS number so far and meanwhile try to avoid 
confusion associated if adding a string of numbers as a regular 
OU field (it is DUNS or SSN or even other number? there is no 
standard way for a client to interpret it). This is just my 
personal understanding about OID choices.

Code signing certificate is another kind of real "Organization 
Certificates". It does represents the company from a user's 
point of view when downloading the signed software. 

As either a passport or driver's license can equally serves 
to identify an individual, different kinds of certificates 
exist to represent a company according to different usages. 
No single certificate seems to be able to serve all. Application 
context would need to define how it recognize a digital ID as 
representation of a company in the context. 

- Ming

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, November 09, 2001 1:02 PM
To: Pei, Mingliang; [email-masked]
Cc: Hsiao, Wentsung
Subject: Re: Any Organization Certificates out there?

Ming,
Interesting.  I put this queston a week ago to [email-masked]
and got no such information!

Then I "dumpasn1":ed https://www.versign.com and there is
no such extension there.

I'm sure this information of yours is correct but it seems to be a
pretty well hidden secret.  And why not put DUNS in OID.2.5.4.5
so it is shows up where the other ID-stuff is?
Or as an extra O=DUNS:887878787?

Under all circumstances a short test verified that few are DUNS-enabled
today.

Anders

----- Original Message ----- 
From: "Pei, Mingliang" <[email-masked]>
To: "'Anders Rundgren'" <[email-masked]>; <[email-masked]>
Cc: "Hsiao, Wentsung" <[email-masked]>
Sent: Friday, November 09, 2001 21:15
Subject: RE: Any Organization Certificates out there?

Hi Anders,

The server certificate issued by VeriSign actually meet your need.
"a unique ID" DUNS number is included in server certificates.
When a customer provides their DUNS# during enrollment for retail 
Secure/Global server ID to VeriSign CA, the certificate issued 
always includes the DUNS# in the server id extension which OID is 
2.16.840.1.113733.1.6.15

- Ming

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Tuesday, November 06, 2001 2:07 PM
To: [email-masked]
Subject: Any Organization Certificates out there?

Hi,
My company is spearheading an effort to create an all
PKI-enabled version of the OBI (Open Buying on the Internet)
standard.  A stumbling block is that the core is based on what
we refer to as a "Digital Company Paper", which is an
organization certificate.  Some people consider Web-server
certificates as organization certificates, and that is true to
some extent, but has a major limitation: A domain name may
be owned by one legal entity and used by many associated
legal entities.  And the typical (non-standardized) other
information like O=x and OU=y is essentially useless
as it is not guaranteed to be unique or stable.  L (Locality) is even
worse as companies relocate quite often.  What you need
are certificates that contains a unique ID in a specified
fictitious (CA-specific) or externally administered
naming domain (National, DUNS etc).

Without such certificates, PKI-based B2B-business will be hard
to achieve as RP's sort of have to guess what IBM legal unit is
associated with a "secure.ibm.com" web-server certificate.
Particularly long-term, usage will break every now and
then due to the "imprecise" way, non-DNS information is applied.
And each renewed cerificate or changed web-server name (like
"secure0.ibm.com" to "secure9.ibm.com" replaces "secure.ibm.com")
is also a possible source of RP-troubles.  At least if plug-and-play
is called for, as in OBI Express.

Do anybody know if there are any *real* organization certificates
out there, available on a *global scale*?

Regards
Anders Rundgren
X-OBI
+46 70 - 627 74 37

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 10 Nov 2001 08:27:37 +0100

Thanx Ming,
Actually I think this is a case for Permanent Identifiers.   If it is
DUNS or not, is IMHO of less importance.  A VeriSign 
"Customer-ID" is equally good assuming that these stay constant etc.

The problem with the [expired] PI-draft as it stands today with respect to
organization certificates is:
- It is intended for individuals.  In spite of being equally interesting for organizations
- It is based on a flawed data model where EE-certs can contain arbitrary (well
I guess the CPS says how arbitrary) such definitions which makes it impossible
to use.  A sound data model would be that the CA-cert (that "owns" and "vouches"
for the EE-certs), indicates that its "children" indeed contains a permanent identifier
and its naming domain etc.  Then an RP can build *very sleek* systems to identify
messages signed by such an EE.  As this is what we do for a living, I can just say
this is a real mess that unfortunately none in this list seems to grip.

Regarding the use of OU etc. in web-server certificates, they are already all over
the map so adding a OU=DUNS/7878887 would have no (negative) impact.

But again, I think this should be addressed through a revised *CA-based*
PI-scheme. 

A "funny" comment on the side: I've been told (off-list) that the use of
web-server certificates for signing business transactions is way out
of what VeriSign allows.  Is this really true?  It is a reality in quite a
few places anyway.

Regards
Anders Rundgren
X-OBI

----- Original Message ----- 
From: "Pei, Mingliang" <[email-masked]>
To: "'Anders Rundgren'" <[email-masked]>; "Pei, Mingliang" <[email-masked]>; <[email-masked]>
Cc: "Hsiao, Wentsung" <[email-masked]>
Sent: Saturday, November 10, 2001 03:28
Subject: RE: Any Organization Certificates out there?

- Ming

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Friday, November 09, 2001 1:02 PM
To: Pei, Mingliang; [email-masked]
Cc: Hsiao, Wentsung
Subject: Re: Any Organization Certificates out there?

Ming,

Anders

----- Original Message ----- 
From: "Pei, Mingliang" <[email-masked]>
To: "'Anders Rundgren'" <[email-masked]>; <[email-masked]>
Cc: "Hsiao, Wentsung" <[email-masked]>
Sent: Friday, November 09, 2001 21:15
Subject: RE: Any Organization Certificates out there?

Hi Anders,

- Ming

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Tuesday, November 06, 2001 2:07 PM
To: [email-masked]
Subject: Any Organization Certificates out there?

Hi,

Regards
Anders Rundgren
X-OBI
+46 70 - 627 74 37

---

From: Michael Ströder <[email-masked]>
Date: Sat, 10 Nov 2001 15:31:32 +0100

> by CA vendors. So it is true that few are DUNS-enabled today.

Where is it documented at Verisign's site?

I already tried without success to get some more information about
how to decode other Verisign vendor-specific extensions like:

Description = verisignCZAG (2 16 840 1 113733 1 6 3)
Description = verisignInBox (2 16 840 1 113733 1 6 6)
Description = verisignCPSv1notice (2 16 840 1 113733 1 7 1 1 1)
Description = verisignCPSv1nsi (2 16 840 1 113733 1 7 1 1 2)

Well, if applications cannot decode it how to make use of it?

Ciao, Michael.

---

From: Henrik Ståhl <[email-masked]>
Date: Sat, 10 Nov 2001 17:30:02 +0100

Hello Michael, 

> Description = verisignCZAG (2 16 840 1 113733 1 6 3)

VeriSignCZAG extension. It holds demographic information. 

The ASN.1 definition is as follows: 

 -- OID in decimal notation: (2.16.840.1.113733.1.6.3)
 -- Definition:
      id-czag OBJECT IDENTIFIER ::= {id-extensions czag(3)}
      CZAG ::= IA5STRING 

> Description = verisignInBox (2 16 840 1 113733 1 6 6)

VeriSignNetscapeInBoxV1 extension for Netscape InBox program
version 1.

The ASN.1 definition is as follows: 

 id-pki OBJECT IDENTIFIER ::= {2 16 840 1 113733 1}
 id-extensions OBJECT IDENTIFIER ::= {id-pki extensions (6)}

 -- Description: Netscape InBox program extension
 -- OID in decimal notation: (2.16.840.1.113733.1.6.6)
 -- Definition:
     id-inboxv1    OBJECT IDENTIFIER ::= {id-extensions inboxv1(6)}
     InBoxV1 ::=   IA5STRING 

> Description = verisignCPSv1nsi (2 16 840 1 113733 1 7 1 1 2)

No info, I'm afraid. BSAFE supports some other Verisign specific
extensions, but not these two.

Regards,

Henrik Ståhl