Subject: RE: Global unique identifier

From: "Ramsay, Ron" <[email-masked]>
Date: Fri, 14 Apr 2000 11:10:21 +1000

But surely the domain of the CA is the totality of subject DNs in all
certificates issued by the CA. For two DNs to be the same in the CAs domain
they must each be the subject DN of a certificate naming the CA as issuer.

There is still a uniqueness problem which is to distinguish between two John
Smiths. For this the CA would require a DN disambiguator.

Ron.

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Thursday, 13 April 2000 22:21
To: 'Denis Pinkas'; 'Heimberg, Jim'
Cc: [email-masked]
Subject: RE: Global unique identifier

Jim,
You are absolutely right that DNs should be globally unique within their
domain. 
The only problem is that we do not have any means (or do we?) to specify (in
a certificate) a domain 
which may be internal (NULL) to the CA or external (hopefully centrally
registered like IPs, OIDs etc.).   
Anders
----------
From:  Heimberg, Jim [SMTP:[email-masked]]
Sent:  Thursday, April 13, 2000 14:13
To:  'Denis Pinkas'; Anders Rundgren
Cc:  [email-masked]
Subject:  RE: Global unique identifier

Denis,
	I am not sure I understand why the DN would not be globally unique.
If it is unique within its domain, there should not be duplication of
domains and thus it becomes globally unique.  Please let me know if there is
some reason that this is not true.
Jim

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Wednesday, April 12, 2000 9:04 AM
To: Anders Rundgren
Cc: [email-masked]
Subject: Global unique identifier

Anders,

In RFC 2459 paragraph 4.1.2.6 we have : "The DN MUST be unique for
each subject entity certified by the one CA as defined by the issuer
name field". There is no requirement to make the DN unique across
multiple CAs. 

Adding this requirement would either break RFC 2459 or build
something very different. Today, when a DN is used, it is a DN from
a given CA. Each CA may build its own tree of names. A sequence of
relative names forming a distinguished name from CA 1 and the same
sequence of names forming the same distinguished name from a CA 2 do
not necessarilly need to point to the same entity. So the name of
the CA has to be used in addition to every DN in order to make the
difference. In other words, if two DNs from two different CAs are
identical, this does not mean that the two entities are necessarilly
identical. This was supposed to be true, ten years ago, when the
Directory (with a capital D) was defined, but this is no more the
case today.

Now let us make the assumption that we introduce an explicit naming
domain information (or naming authority information) in some form of
name. Note that this topic does not apply only to the permanent
identifier but could apply as well to the DN: this is why it should
be discussed on a different thread. 

As a conclusion, this particular aspect should be discussed on a
separate thread (I have called it "Global unique identifier" but you
may use any other name you prefer, as long as it is not "permanent
identifier").

Denis

> Denis,
> <snip>
> >Please, do not make the story more complicated than requested. The
> >permanent identifier is a name of the subject, unique within the
> >issuer domain, that is not reused over time for another subject. The
> >name is only unique within the issuer domain (i.e. CA). Making the
> >name unique across different CAs would break the current PKIX model.
> 
> The requirement stated by Tom is very valid (I have raised it on this list
a countless number of times)
> and applies 100% to what is supposed to be happening any old day here in
Sweden.
> I.e. a number of competing CAs issue certificates to a Naming Domain they
do not govern themselves.
> These identity certificates are supposed to be totally interchangeable as
their physical counterparts
> have been the last 30 years or so.  By the use of a permanent ID and
(implicit) naming domain.
> 
> I.e. any improvement or addition to QC must address the naming domain
question as well.
> Or as Tom prefers.  The naming authority.
> 
> Anders

---

From: Ed Gerck <[email-masked]>
Date: Thu, 13 Apr 2000 19:56:23 -0700

> they must each be the subject DN of a certificate naming the CA as issuer.

 Section 11.2 of X.509v3, "Management of certificates", states that the certificate
 allows an association between a name called "unique distinguished name" or DN
 for the user and  the user's public-key: "A  certificate  associates  the public key
 and unique distinguished name of the user it describes.", while Section 7 explains
 that such DNs are essential to the security design of X.509: "Authentication relies
 on each user possessing a unique distinguished name." But, how are such DNs
 assigned? Where are they unique? The DN is  denoted by a NA (Naming Authority)
 and accepted by a CA (Certification Authority) as unique within the CA's domain,
 where the CA can double as a NA. It is interesting to  note that the same user can
 have different DNs in different CAs, or can use the same DN in different CAs even
 if it is not the first one to use it in a CA -- so different DNs for different CAs do not
 necessarily mean different users and vice-versa. Further, a DN does not have to
 contain the user's real-world name or location. Thus, semantically, the CA
 certificate refers to a name; however it does not denote it.

(in http://www.mcg.org.br/cert.htm)

Cheers,

Ed Gerck