Subject: Re: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "David P. Kemp" <[email-masked]>
Date: Fri, 14 Jul 2000 16:01:37 -0400 (EDT)

> From: Denis <[email-masked]>

> 
> Full text proposal replacement for 3.1.1:
> 
> 3.1.1  Issuer
> 
> The issuer field SHALL identify the organization responsible for
> issuing the certificate.
> 
> The identity of the issuer SHALL be specified using an appropriate
> subset of the following attributes:
> 
>          domainComponent;
>          countryName;
>          stateOrProvinceName;
>          organizationName;
>          localityName; and
>          serialNumber.
> 
> Additional attributes MAY be present but they SHOULD NOT be necessary to 
identify the issuing
> organization. The first element of the DN shall be the country where the CA is 
operating from.

The last sentence conflicts with the presence of domainComponent as
one of the allowed attributes, as there is no well-defined method of
constructing a DN containing a mixture of DC and other attributes.

If it is necessary to identify the local laws under which the QC is
interpreted, the jurisdiction should be identified using something other
than the first element of the issuer DN.  An "organization responsible
for issuing the certificate" may operate in multiple jurisdictions, so
even where the DN begins with C=xx, interpreting "xx" as a jurisdiction
may be misleading (and should be performed with care :-).  Did the
Stockholm discussion consider the possibility of multi-country CAs?

Dave

---

From: Denis <[email-masked]>
Date: Sun, 16 Jul 2000 18:52:11 +0200

Dave,

My response below.

> constructing a DN containing a mixture of DC and other attributes.

Everything depends from the ordering. If the domainComponent comes in the second
position, then there is no problem. If people may think it is the first componet,
then it should be deleted.

> Stockholm discussion consider the possibility of multi-country CAs?

The European Directive requires a supervision system where each (European) country
must supervise the CAs which are established on its territory. Hence why "CN" shall
come first.

Denis