Subject: Re: QC DN "qualities". Was: I-DACTION:draft-ietf-pkix-qc-04.txt

From: [email-masked]
Date: Fri, 28 Jul 2000 18:39:45 -0400

Without getting into the question of whether bureaucratic organization
is obsolete (personally, I doubt that it is all that obsolete), you can
just cite the non-quantitative and almost undisputed version of the Rule of
Revocation:  "Every additional attribute or extension added to a
certificate shortens its life expectancy".  Leaving out which department a
given subject belongs to has to increase the life expectancy of the
certificate.  If an ID is assigned by an organization for as long as the
subject is associated with the organization, then it doesn't really
decrease the life expectancy of a certificate that already contains that
organization's name, while organizational details or place of residence do.

          Tom Gindin

"Anders Rundgren" <[email-masked]> on 07/28/2000 07:15:40 PM

To:   "Stephen Kent" <[email-masked]>
cc:   "PKIX-List" <[email-masked]>
Subject:  Re: QC DN "qualities". Was: I-DACTION:draft-ietf-pkix-qc-04.txt

Steve,

>Anders,
>
>There are no ID forms that are both globally unique and globally
>meaningful. We use names in contexts, and relate to people by names
>in context. That's why a name structured along org and dept lines is
>attractive, despite the fact that it requires more frequent
>revocation and re-issuance of certs.

I never said I don't understand why people make such certs but I believe
they are applying PKI in a less than optimal way. To *have to* revoke a
certificate
due to a changed department seems like a bad solution.

Directories (and other external databases) ought to be a much better way to
look
for additional information  concerning a subject within a certain domain
than trying to
squeeze in unstable data such as department in a certificate.

And outside the organization domain, departments does not mean that much.

There is also a great risk that you during the transitional phase between
two
departments can find yourself be stuck with a useless or revoked
certificate.

By leaving out department you can even be a valid member of more than
one department!

My conclusion: Departments and such stuff are just relics from the *almost*
extinct, static, off-line world.

<snip>

Anders

---

From: Stephen Kent <[email-masked]>
Date: Fri, 28 Jul 2000 18:47:32 -0400

Tom,

>organization's name, while organizational details or place of residence do.

While it's heartening to hear variants of "Steve's Rule of 
revocation" cited, there is still an issue of whether the name assert 
in the subject address the fundamental needs of the RPs. If not, then 
the reduced revocation frequency is irrelevant.

Steve