Subject: Denis remaining QC comments

From: Stefan Santesson <[email-masked]>
Date: Sun, 30 Jul 2000 20:39:23 -0600

Denis,

I'm working on my "Make Denis Happy" list, to which I dedicate all my best 
efforts right know.
In this mail I will try to clean up in the somewhat messy debate.

Generally we disagree about everything we debate here, but since we only 
debate less than 1% of the document, it must mean that we agree on more 
than 99% of the stuff :-).
Lets see if we can increase that positive factor and get over the finish line.

My summary is:

COMMENT 1
Issue: Uniqueness of DN over the lifetime of the CA

Fixed in qc-05

COMMENT 2
Issue: Use of the term "registered name" for Issuer DN

You want the term removed and I think it serves a purpose to keep it.
Basically I don't understand the SERIOUS problem with this..

I think that the current text is OK but I could live with having this removed.

COMMENT 3
Issue: Legal Jurisdiction

We basically agree that the legal jurisdiction of the CA should be 
consistent with the issuer DN. We argue however about wordings. Right?

COMMENT 4
Issue: Use of policy OID to state that a QC is a QC

Here we agree on the principle that the Issuer should be allowed to 
communicate the fact that a QC is a QC by just including a policy OID, 
defining this property. We consequently agree that use of the QCstatements 
extension for this purpose is optional. There is still some argue about 
wordings.Right?

For your information you fully misunderstood my comment about ETSI's policy 
OID:s. I'm fully aware that ETSI is producing 2 policy OID:s. What I mean 
is that I doubt that ETSI will define a 3:rd policy OID that JUST declare 
conformance with the EU directive Annex I and II and nothing else.

COMMENT 5
Issue: definition of a new extension for reliance limit.

Here is the first disagreement of concept. Even though I would not oppose a 
WG consensus on a new extension according to your proposal, I would argue 
against it. There is NO way that such change will just sneak in without 
going through a thorough WG debate, followed by a new WG last call and then 
proceed. This will cost considerable time and I truly doubt that 1) the 
solution will be better and 2) that it is worth a delay that will 
permanently kill the ETSI timetable.

There is no technical argument either against your solution or the current 
one, since both will work technically if supported by the market.

We will have to remind us though that we standardize the solutions of 
tomorrow. It will always take some time before a standard gets deployed. 
Until then CA's will find other quick and dirty ways to display this type 
of information (such as CA's today commonly use OU attributes in the 
subject and Issuer field to display disclaimer information)

Nor your solution nor the current one can change that. I hope to convince 
you that changing direction now will only make things worse, due to time 
delay, not better.

COMMENTS 6&7
Issue: Wordings in the security considerations section.

Except for the fact that I don't have a clue what you mean when you say 
that POP is not needed when the NR-bit is set, I see only disagreement of 
wordings.
Since this is just a security section, I hope that this won't be a major 
problem.

---------------------

Finally I would hope that we could agree to advance the document as it is, 
and then debate the minor wordings disagreements after having an RFC. I 
mean, even if we fix these comments to your 100% satisfaction, I promise 
that we will find more to argue about anyway :-)

Since the QC document has passed WG-last call I guess we will have to 
discuss this with Stephen and Warwick and see if we can reach some kind of 
resolution.

Hope to see you here in Pittsburgh

/Stefan