Subject: draft-ietf-pkix-ldap-* consistency issues

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 30 Nov 2004 16:24:24 -0800

draft-ietf-pkix-ldap-pkc-schema-01 basically proposes to copy certificate
information from the entries representing the entity which possess the
certificate to a separate certificate entry.  I consider relocation not to
be feasible option whatsoever as it will simply break some
existing clients which use basic certificate matching, as well as
existing and future clients which makes component matching with
certificates.  However, the document actually reads as if relocation
of the information is intended.

This text causes me concern:
>   If certificates are stored redundantly in person entries and in      
>   certificate entries below the person entries, maintainers of
>   repositories MUST make sure that the same certificates are stored in
>   the person entry and the respective certificate entries and keep this
>   consistency.  Alternatively, they MUST leave out any certificates in
>   the person entry.

Now, given that maintainers will be hard pressed to ensure
consistency, this specification has stated that the standard
track approach of storing certificates in the person entry
is not to be followed.   This MUST will lead to breakage.

Instead, this document needs to needs to make it clear that
certificates will be stored redundantly, there will be
consistency issues, and then discuss how applications are
to address these consistency issues.

Kurt

PS: I note that these MUSTs appear to apply to users, not to
implementations... they likely should be downcased.