Subject: Re: QC DN "qualities". Was: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 24 Jul 2000 07:58:31 +0200

Ed,

I think you take the concept of not reisssuing DNs to a level where it does not belong!

Probably you don't agree to the idea that a CA/RA should/can keep records of its subjects.
That makes the discussion somewhat uninteresting as this is the foundation of
most CAs in the X500-world.

<large cutoff>

>Besides, note that creating national IDs in order to uniquely identify people is
>forbidden by the constittution of ALL EC countries.

I doubt that this can be confitmed  as both Finland and Sweden have national IDs!

> What would a certificate
>that purports to uniquely identify people within a country be but ... a national ID?

There are two *big* errors here

1.  "Uniquely identify" to be useful by RPs requires UIDs which is *not* a QC requirement.
Not reissuing DNs does *not* imply that certs will use UIDs.   A name distinguisher may even be
counting between certs for the same user!  But if the real problem is that the CA knows its
subjects then you are back to square one...

2. The scope of CAs that knows its subjects is completely arbitrary. 

>Where is Sweden, BTW?

In deep s**t guess...

Anders

---

From: Ed Gerck <[email-masked]>
Date: Sun, 23 Jul 2000 23:13:02 -0700

> I think you take the concept of not reisssuing DNs to a level where it does not belong!

I see no difficulties in reissuing DNs. In fact, I see a clear need.  Artificially making
DNs one-shot names will not work IMO but you are free to try to convince others.

> most CAs in the X500-world.

I don't see the connection between keeping records (which is mandated by law, for
example) and *permanently using* those records.  Those records are history, not
present.

> I doubt that this can be confitmed  as both Finland and Sweden have national IDs!

I do not intend to tell you about the constitution of your own country but it is a
public fact that the EC demands as condition for countries to enter the EC that
they must change their constitution if they do not have the provision I mentioned.

Personally, I think that national IDs are a security risk but others may surely think
otherwise and see then as a security *gain*.   And if to have security you must
break everyone's privacy, then you are not making a good choice IMO.  Privacy
is a long term asset whereas security is a short term goal.  Ask yourself -- what has
full security but zero privacy?  A prison.

If you really want to have national IDs and identify people by data in them,
then you need first to cope with Tony Bartoletti's suggestion -- that users
facing such threat should immediately publish their IDs so that anyone
else could use them!

> There are two *big* errors here

Again, we diverge.  Thanks for the comments.

Cheers,

Ed Gerck