Subject: RE: QC DN "qualities". Was: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "Heimberg, Jim" <[email-masked]>
Date: Fri, 14 Jul 2000 11:54:25 -0400

OK, maybe my meager mind is confused, this being Friday and all.  I can't
refrain from asking the obvious question.  Is there confusion between what a
distinguished name is and what a common name is.  Since the DN is a
contatenation of the common name and the domain path to it in the common
directory structure for that domain, I have trouble envisioning DNs that are
not unique unless there is a plan afoot to create duplicate domains using
the same domain names. ???

Jim

-----Original Message-----
From: Paul Koning [mailto:[email-masked]]
Sent: Friday, July 14, 2000 11:47 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked];
[email-masked]
Subject: Re: QC DN "qualities". Was: I-D
ACTION:draft-ietf-pkix-qc-04.txt

>>>>> "Anders" == Anders Rundgren <[email-masked]> writes:

 Anders> Paul, <snip>

 >>> I assume that the ETSI group means that CA/RAs in some countries
 >>> can't keep track of the people they certify.
 >>> 
 >> No! In law and administration of some countries, there is no
 >> concept of "unmistakable identity". I was taught that this is
 >> deliberate policy in protection of civil liberties.  The principle
 >> is that, if an administration has control over an unmistakable
 >> identity

 Anders> Pardon me but I don't get it.  If my statement about ETSI is
 Anders> correct the whole idea of certification is flawed but you say
 Anders> my statement is incorrect.  IMO that means that the
 Anders> adminstration DO know their subjects which you claim they
 Anders> don't for liberty reasons.

Actually, no.  For one thing, in the USA there are no "subjects".  But
even if you mean "citizens", the administration doesn't know them
all. There are plenty of ways to become known to the various
administrations (get a driver's license, register to vote, etc.) but
those various registries aren't necessarily tied together, the names
used aren't necessarily the same, and you aren't under legal
compulsion to do any of these things if you can put up with the
inconvenience of not doing so.

In particular -- and we've been through this before in detail many
months ago -- the whole concept of unmistakable identity doesn't work
in the USA.  There isn't any central registry of identities, and names
aren't immutable.

       paul

---

From: Ben Laurie <[email-masked]>
Date: Fri, 14 Jul 2000 21:11:56 +0100

> the same domain names. ???

Will this never end? The problem is that there is no "domain path to it
in the common directory structure for that domain" coz that's the bit
that never happened (i.e. a global infrastructure for unique DN
allocation).

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe 2000? http://apachecon.com/