Subject: Re: QC DN "qualities". Was: I-D ACTION:draft-ietf-pkix-qc-04.txt

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 14 Jul 2000 20:55:58 +0200

Paul,

>Tom
>>
>In fact, X.509v3 section 11.2 has a note which
>>states "a certification authority shall not issue certificates for two
>>users with the same name", 
>>
>This is not the point at dispute. The QC text used to have an additional
>requirement that a QC contained "an unmistakable identity ... which ...
>relates to a specific entity."  It also contained the concept of "a
>corresponding officially registered identity".  
>
>The contentious point is that this requirement has been dropped.  the reason
>is that, in some jurisdictions there is simply no support for the
>"unmistakable" concept.  Thus the subject name can be unique within the CA's
>name space. 

This last line is actually the thing requested by Denis and by me!

But even that is said to be impossible to achieve for reasons so
far not particularly well explained.

I.e. this requirement is purely technical and has nothing to do with official
identities etc.  It simply requires CAs to keep track of its own subjects and
not issue ambigious DNs or resissue already used DNs.

Involves IMO no politics or magic, just plain engineering.

If resolved it affects things like cert compares.

Anders

---

From: Ed Gerck <[email-masked]>
Date: Sun, 23 Jul 2000 01:20:41 -0700

Anders,

what you ask cannot be done in X.509/PKIX and will fail if tried.

There are three main reasons for failure:

1. technical:  The old Bob Jones example.

2. commercial: CAs make mistakes and may issue the same DN for
two different people. They do not want to be liable for it.

3. revocation: if a cert is revoked with DN "X" for entity A then that DN
may be reused for entity B. However, revocation of certificates does
not revoke certs -- it merely puts them in a black list. There may be
any number of certs with "X" for A in the world which have not yet
been revoked by a client app, and may thus clash with  a cert that also
has  "X" but for B.

There are also other reasons. It is thus much better security-wise to avoid
a false sense of security and leave matters as they are now.  A certificate
is a hint, QC or not QC, no more, no less.

Cheers,

Ed Gerck