Subject: Re: QC DN "qualities". Was: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 14 Jul 2000 12:49:29 +0200

<snip>

Denis wrote:

>> >In order to make the text unambiguous it is important to say that: "The 
>> DN MUST be unique  for
>> >each subject entity certified by the one CA as defined by the issuer 
>> name field during the whole
>> >life time of the CA, i.e. two different living human beings cannot have 
>> the same DN."

Stefan responded:

>I agree that this is a good practice. There are however limitations on how 
>far you can make requirements on practice in a technical profile.

QC is not 2459.  QC is supposed to support legal systems and MARKET needs.
For a CA that adhere to the word "Qualified" this is not a hard thing to require.
It is anyway obliged to keep track of its subjects.  So what is the problem????

Without restrictions on DNs QC is IMO redundant.  With the restriction requested by Denis
you got a useful product (sorry - "techical profile" if that feels better).

May I kindly ask potential issuers of QCs to either stand by this statement or
not?

Anders

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 14 Jul 2000 14:17:09 +0200

Anders,

The "technical profile" specify what attributes to use, what type of 
information to put in them and also states technical uniqueness 
requirements. The technical uniqueness requirement from RFC 2459 stands.

The requirement that 2 physical persons never can have the same DN, is to 
go beyond a technical uniqueness  concept.

I tried to have a "functional" requirement in there (the unmistakable 
identity requirement), but got the whole European ETSI group against me 
saying that such requirement, regardless how desirable it might be, can't 
be 100% globally accomplished in a practical world (in all countries).

We must recognize that the real world have a context factor that we never 
can capture in a technical standard.

Last IETF/PKIX meeting decided that Denis "Permanent Identifier" topic 
should be advanced in a separate work item to be merged later, if 
successful, with RFC 2459 or the QC profile.

That work has first to prove that you can make a useful "technical" 
definition of the uniquness requirement in "permanent identifiers", which 
still remains to be done.

/Stefan