Subject: Re: QC DN "qualities". Was: I-DACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 29 Jul 2000 01:15:40 +0200

Steve,

>Anders,
>
>There are no ID forms that are both globally unique and globally 
>meaningful. We use names in contexts, and relate to people by names 
>in context. That's why a name structured along org and dept lines is 
>attractive, despite the fact that it requires more frequent 
>revocation and re-issuance of certs. 

I never said I don't understand why people make such certs but I believe
they are applying PKI in a less than optimal way. To *have to* revoke a certificate 
due to a changed department seems like a bad solution.  

Directories (and other external databases) ought to be a much better way to look
for additional information  concerning a subject within a certain domain than trying to
squeeze in unstable data such as department in a certificate. 

And outside the organization domain, departments does not mean that much. 

There is also a great risk that you during the transitional phase between two
departments can find yourself be stuck with a useless or revoked certificate.

By leaving out department you can even be a valid member of more than
one department!

My conclusion: Departments and such stuff are just relics from the *almost* extinct, static, off-line world.

<snip>

Anders

---

From: Stephen Kent <[email-masked]>
Date: Fri, 28 Jul 2000 18:44:41 -0400

Anders,

>due to a changed department seems like a bad solution.

I usually get new business cards when my job changes (internally), so 
why not just consider this to be another item I have to change?

>squeeze in unstable data such as department in a certificate.

But directories are not viewed as secure, and hence they are not 
reliable sources of such data, unless the data is signed. If one uses 
attribute certs this is manageable for access control purposes, but 
it still does not address the fundamental issue of mapping certs to 
entities in the real world, which requires context.

>My conclusion: Departments and such stuff are just relics from the 
>*almost* extinct, static, off-line world.

We disagree, as usual. Maybe too much emphasis on departments. Still, 
an example may help. In our company we have a voice recognition 
system that listens to a name and dials the phone number of the 
person we want to call. How do we differentiate between two people 
with the same first and last names?  We don't add in the middle name, 
because most people would not know it and so, even though it would 
serve to make more names unique, it would fail to be meaningful to 
the caller.  Instead we add in a qualifier such as office locale 
(city) or department, etc.  This is not a PKI problem, its a general 
"how do you name the individual meaningfully and uniquely" problem.

Steve