Subject: QC DN "qualities". Was: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 14 Jul 2000 10:41:46 +0200

Denis,

<snip>

>In section 4.1.2.6  Subject, RFC 2459 states: "The DN MUST be unique for each subject entity
>certified by the one CA as defined by the issuer name field."
>
>In order to make the text unambiguous it is important to say that: "The DN MUST be unique  for
>each subject entity certified by the one CA as defined by the issuer name field during the whole
>life time of the CA, i.e. two different living human beings cannot have the same DN."

That is definitely a Quality that QCs should have!  I have already asked about that zillions
of times with no comments so I guess the authors do not agree....

<snip>

>Section 4, Security considerations. The current text is as follows:

>"Comparing two qualified certificates to determine if they represent
>the same physical entity may provide misleading results and should be
>performed with care."

>This sentence does not help. Replace by:
>
>"Comparing two qualified certificates, that contain different DNs, to determine if they represent
>
>the same physical entity cannot be made."

This is of course correct but the interesting case is when DNs are equal.  But I assume
that you mean that you can ALWAYS count on the equality case due to the guarantee that
a QC CA must never reissue a DN.

Again, I really like this (and have myself requested this several times) but this is also departs quite a bit from QC-4!

IMO, the two issues mentioned are genuine MARKET REQUIREMENTS rather than just "technicalities".

Anders

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 14 Jul 2000 11:22:03 +0200

Anders,

>of times with no comments so I guess the authors do not agree....

I agree that this is a good practice. There are however limitations on how 
far you can make requirements on practice in a technical profile.

I think your requirement is more suitable in the applicable policy and in 
the national legislation within the country under which a CA is eastblished.

> >the same physical entity cannot be made."

Well, this is not true. Comparison can certainly be made in many cases 
within a known context. What the current text implies is that you muste be 
careful and not compare names in contexts where comaprisons don't give the 
desired result.

The definition of context is outside the scope of the technical standards 
work, causing this maby "odd" wording.
If the wording is bad, then I suggest that you come up with some better 
wording. I'm sure that we can then uppgrade the process with this. At least 
on the way to draft standard.

>a QC CA must never reissue a DN.

Again. There are som contexts where comparison is both possible and useful. 
You just have to be careful (at least when creating the application 
comparing certificates) that you compare withing a working context.

>Again, I really like this (and have myself requested this several times) 
>but this is also departs quite a bit from QC-4!
>

/Stefan