Subject: Re: QC DN "qualities". Was: I-DACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 28 Jul 2000 12:37:42 +0200

<snip>

>> I.e. If you have a Swedish certificate with Swedish civic registration
>> number. Then you can know that the DN represent the same person even if
>> some other data is differing.
>
>There is no specific rule that you can apply to a Swedish
>certificate to bear a different semantics of *one* component of the
>DN (ie. the Swedish civic registration number, which is the last
>component of the name). The same rules apply to all certificates,
>hence there is no notion of "context".

Denis,
Stefan is right.  Unfortunately you must know a lot of things before you
can treat certs in such a way.  This usage is wrong according to some notable people
on this list but this is also the reality.

Is not this almost the sole reason you and Tim work with the PI-specification?

Anders

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 28 Jul 2000 12:00:11 +0200

Anders,

> on this list but this is also the reality.

You cannot say "Stefan is right" while you say just after "this
usage is wrong". :-)
Neither RFC2459, nor son-of-RFC2459, nor QC-05 makes such an
interpretation of the serial number component of the DN.

> Is not this almost the sole reason you and Tim work with the PI-specification?

This is one of the reasons, but not the single one.

Denis

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 28 Jul 2000 07:50:02 -0600

> >hence there is no notion of "context".

This last comment is not correct.

Yes it is right that there is no definition of context in the subject field 
but there are several other ways by which the relying party can determine 
context.

1) By recognizing an implicit policy for all certificates issued under a 
certain root CA
2) By implicit knowledge of certificates issued by a certain CA
3) By information defined by a contained policy OID
4) By explicit definition in the QCStatements extension

There might be others but these are enough to demonstrate my point.

/Stefan