Subject: Re: QC DN "qualities". Was: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 14 Jul 2000 18:26:06 +0200

Paul,

<snip>

>>I assume that the ETSI group means that CA/RAs in some 
>>countries can't keep track of the people they certify. 
>>  
>No! In law and administration of some countries, there is no concept of
>"unmistakable identity". I was taught that this is deliberate policy in
>protection of civil liberties.  The principle is that, if an administration
>has control over an unmistakable identity

Pardon me but I don't get it.  If my statement about ETSI is correct
the whole idea of certification is flawed but you say my statement is
incorrect.  IMO that means that the adminstration DO know their subjects
which you claim they don't for liberty reasons.

Note: We are NOT talking about social security numbers.  That's another issue.

<snip>
>>How useful are legally binding signatures under such circumstances?

>We have managed to have legally effective signatures for over 1000 years
>under such circumstances - so quite useful I guess.

But in the older days you did not met millions of people on web and there
where no CAs issuing certificates either.  

And they did not possess powerful databases capable of storing data about
the entire terrestial population (which is in reach for a PC these days).

Even in limited naming-domain like a typical school-class, you refer to "Mary M" and
"Mary K" for very good reasons.

Paul, maybe you could name a potential QC CA that wants to issue ambigious DNs???

Anders

---

From: Paul Koning <[email-masked]>
Date: Fri, 14 Jul 2000 11:46:37 -0400 (EDT)

>>>>> "Anders" == Anders Rundgren <[email-masked]> writes:

 Anders> Paul, <snip>

 >>> I assume that the ETSI group means that CA/RAs in some countries
 >>> can't keep track of the people they certify.
 >>> 
 >> No! In law and administration of some countries, there is no
 >> concept of "unmistakable identity". I was taught that this is
 >> deliberate policy in protection of civil liberties.  The principle
 >> is that, if an administration has control over an unmistakable
 >> identity

 Anders> Pardon me but I don't get it.  If my statement about ETSI is
 Anders> correct the whole idea of certification is flawed but you say
 Anders> my statement is incorrect.  IMO that means that the
 Anders> adminstration DO know their subjects which you claim they
 Anders> don't for liberty reasons.

Actually, no.  For one thing, in the USA there are no "subjects".  But
even if you mean "citizens", the administration doesn't know them
all. There are plenty of ways to become known to the various
administrations (get a driver's license, register to vote, etc.) but
those various registries aren't necessarily tied together, the names
used aren't necessarily the same, and you aren't under legal
compulsion to do any of these things if you can put up with the
inconvenience of not doing so.

In particular -- and we've been through this before in detail many
months ago -- the whole concept of unmistakable identity doesn't work
in the USA.  There isn't any central registry of identities, and names
aren't immutable.

       paul