Subject: RE: Global unique identifier

From: "Heimberg, Jim" <[email-masked]>
Date: Thu, 13 Apr 2000 08:12:40 -0400

Denis,
	I am not sure I understand why the DN would not be globally unique.
If it is unique within its domain, there should not be duplication of
domains and thus it becomes globally unique.  Please let me know if there is
some reason that this is not true.
Jim

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]]
Sent: Wednesday, April 12, 2000 9:04 AM
To: Anders Rundgren
Cc: [email-masked]
Subject: Global unique identifier

Anders,

In RFC 2459 paragraph 4.1.2.6 we have : "The DN MUST be unique for
each subject entity certified by the one CA as defined by the issuer
name field". There is no requirement to make the DN unique across
multiple CAs. 

Adding this requirement would either break RFC 2459 or build
something very different. Today, when a DN is used, it is a DN from
a given CA. Each CA may build its own tree of names. A sequence of
relative names forming a distinguished name from CA 1 and the same
sequence of names forming the same distinguished name from a CA 2 do
not necessarilly need to point to the same entity. So the name of
the CA has to be used in addition to every DN in order to make the
difference. In other words, if two DNs from two different CAs are
identical, this does not mean that the two entities are necessarilly
identical. This was supposed to be true, ten years ago, when the
Directory (with a capital D) was defined, but this is no more the
case today.

Now let us make the assumption that we introduce an explicit naming
domain information (or naming authority information) in some form of
name. Note that this topic does not apply only to the permanent
identifier but could apply as well to the DN: this is why it should
be discussed on a different thread. 

As a conclusion, this particular aspect should be discussed on a
separate thread (I have called it "Global unique identifier" but you
may use any other name you prefer, as long as it is not "permanent
identifier").

Denis

> Denis,
> <snip>
> >Please, do not make the story more complicated than requested. The
> >permanent identifier is a name of the subject, unique within the
> >issuer domain, that is not reused over time for another subject. The
> >name is only unique within the issuer domain (i.e. CA). Making the
> >name unique across different CAs would break the current PKIX model.
> 
> The requirement stated by Tom is very valid (I have raised it on this list
a countless number of times)
> and applies 100% to what is supposed to be happening any old day here in
Sweden.
> I.e. a number of competing CAs issue certificates to a Naming Domain they
do not govern themselves.
> These identity certificates are supposed to be totally interchangeable as
their physical counterparts
> have been the last 30 years or so.  By the use of a permanent ID and
(implicit) naming domain.
> 
> I.e. any improvement or addition to QC must address the naming domain
question as well.
> Or as Tom prefers.  The naming authority.
> 
> Anders

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 13 Apr 2000 16:00:39 +0200

>         I am not sure I understand why the DN would not be globally unique.

This was the ISO dream in the 90's.  :- ) 

A CA can nominate the Delta Company from country FR, but another CA
can nominate another Delta Company from the same country. There
cannot be an ambiguity on the country name, because the way country
names are used is well described. For any other level, the
interpretation is free. Thus there is no way to make sure that the
two Delta companies are the same, since there is no naming authority
telling how "Delta Company" should be interpreted or undertsood.

> domains and thus it becomes globally unique.  

No. As explained above, unique within the CA domain does not mean
universally unique across all CAs.

> Please let me know if there is some reason that this is not true.

Done. 

Regards,

Denis

---

From: Janus Liebregts <[email-masked]>
Date: Thu, 13 Apr 2000 16:44:08 +0200

> This was the ISO dream in the 90's.  :- )

This is still our dream in the Netherlands. In our policy we only
certify DN's which are stored in our ldap-DIT:
http://ldap.surfnet.nl:8888/ The DN's certificates are stored in their
ldap-entries.
For the c=nl we can guarantee names are unique, in a european effort we
try to couple national ldap-infrastructures see:
http://www.terena.nl/task-forces/ http://www.dante.net

on a local base we think about delegating the c=nl, o=... to the dutch
Chamber of Commerce and the c=nl, l=... to the ministry responsible for
the dutch localities.

I think naming is a policy matter. 

Janus Liebregts
SURFnet
The Netherlands

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 13 Apr 2000 18:23:42 +0200

> http://ldap.surfnet.nl:8888/ The DN's certificates are stored in their

You give water to Anders's mill. :-)

In your case you would say that the naming authority is something
like: "Netherlands ldap-DIT".

Introducing that component as a part of the DN may allow you to have
that uniqueness. However ... the syntax of the name would be
correct, but the semantics would not change, ... unless in the CP
policy (which is not easily universally machine processable) you
state that the presence of that component implies that the name that
follows it is unique for the Netherlands.

Anders was looking, I guess, for generic way to express that
uniqueness (i.e. not using the CP). There would be various solutions
for that, including an extension to the DN syntax.

Regards,

Denis

---

From: Ed Gerck <[email-masked]>
Date: Thu, 13 Apr 2000 12:48:32 -0700

> telling how "Delta Company" should be interpreted or undertsood.

Yes, and according to X.509, it may not even be unique within
*the same* CA.  Or, would the Jim Jones have all to choose different CAs?

More on this  in http://www.mcg.org.br/certover.pdf

Cheers,

Ed Gerck