Subject: Re: QC DN "qualities". Was: I-DACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 28 Jul 2000 16:52:20 +0200

Denis,

>> >There is no specific rule that you can apply to a Swedish
>> >certificate to bear a different semantics of *one* component of the
>> >DN (ie. the Swedish civic registration number, which is the last
>> >component of the name). The same rules apply to all certificates,
>> >hence there is no notion of "context".
>
>> Stefan is right.  Unfortunately you must know a lot of things before you
>> can treat certs in such a way.  This usage is wrong according to some notable people
>> on this list but this is also the reality.
>
>You cannot say "Stefan is right" while you say just after "this
>usage is wrong". :-)
>Neither RFC2459, nor son-of-RFC2459, nor QC-05 makes such an
>interpretation of the serial number component of the DN.

In my opinion it does not matter what the spec. says as an interpretation
of this kind is needed to re-create the *functionality* of the Swedish ID-system in PKI. 
In Sweden, names are in principle variable attributes, civic registration number is identity.
Of course they could have put the names in SubjectAltNames but that would look awful
when you see the cert in Internet Explorer or Navigator.  Admittely the Swedish solution
is not rocket-science or very clean, but the culprit is really X509/PKIX that lacks proper
support for schemes like that.

I am also 100% sure that this is also performed in many organization-oriented PKIs as
it is just plain stupid to lose or have to renew a link to a "numbered person" beacuse
they changed name or department.  Why then bother with names and departments in the first
place one could argue?  Well, it is the old way of doing things (hard to change) and when
you got that first contact with a new RP it helps a bit to know that you are not only "6575765" but also 
"Marion Anderson"

>> Is not this almost the sole reason you and Tim work with the PI-specification?

>This is one of the reasons, but not the single one.

Enlighten me! What are the other *major* reasons (i.e. beyond limiting the need for "smart", non-standard DN iterpretation)?

Anders

---

From: Stephen Kent <[email-masked]>
Date: Fri, 28 Jul 2000 10:58:04 -0400

Anders,

There are no ID forms that are both globally unique and globally 
meaningful. We use names in contexts, and relate to people by names 
in context.  That's why a name structured along org and dept lines is 
attractive, despite the fact that it requires more frequent 
revocation and re-issuance of certs. It is also why no single cert is 
likely to be appropriate for identifying individuals in all contexts. 
Moreover, we often use name in certs as inputs for access control 
decisions.  because many such decisions are made based on 
organizational structure, it is convenient to embed that structure in 
subject names, e.g, it allows for structured ACL entries.

Steve