Subject: RE: Global unique identifier

From: Anders Rundgren <[email-masked]>
Date: Wed, 12 Apr 2000 15:29:08 +0200

Denis,

>In RFC 2459 paragraph 4.1.2.6 we have : "The DN MUST be unique for
>each subject entity certified by the one CA as defined by the issuer
>name field". There is no requirement to make the DN unique across
>multiple CAs. 

Agreed, and I think the definition is OK.

>Adding this requirement would either break RFC 2459 or build
>something very different. Today, when a DN is used, it is a DN from
>a given CA.

Unless they conform to an "external naming/identification scheme".  But that does not
break 2459, it just extends it.

<snip>

>Now let us make the assumption that we introduce an explicit naming
>domain information (or naming authority information) in some form of
>name. Note that this topic does not apply only to the permanent
>identifier but could apply as well to the DN: this is why it should
>be discussed on a different thread. 

I definitely agree that this apply to the entire DN.

>As a conclusion, this particular aspect should be discussed on a
>separate thread (I have called it "Global unique identifier" but you
>may use any other name you prefer, as long as it is not "permanent
>identifier").

New tread? Nema problema!  Regarding global unique identifier I would prefer
that the external naming domains where registered centrally as they will be few.

Essentially only one per country at maximum.   Companies etc. and commercial
issuers like VerySign will use CA-specific naming domains I suppose?

Anders
,

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 12 Apr 2000 10:42:00 -0400

>issuers like VerySign will use CA-specific naming domains I suppose?

No.  Get real.

A GUI would perforce be the IssuerName concatenated with the SubjectName.

I can even seen problems there, wtih WTO or WIPO hving to deal with suits 
and counter suits between CAs that use the same name.  At least with DNS we 
stopped the independent root efforts.

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]