Subject: RE: OCSP identifiers

From: Frank Balluffi <[email-masked]>
Date: Thu, 16 Nov 2000 17:54:59 -0800

Rich,

If RFC 2459 says:

   The serial number is an integer assigned by the CA to each
   certificate.  It MUST be unique for each certificate issued by a
   given CA (i.e., the issuer name and serial number identify a unique
   certificate).

why are issuer + serial number, and issuer + subject + serial number not
unique? Is this an example of reality not agreeing with theory?

Frank

> -----Original Message-----
> From: Rich Salz [mailto:[email-masked]]
> Sent: Wednesday, November 15, 2000 8:45 PM
> To: [email-masked]
> Subject: OCSP identifiers
> 
> 
> Be careful of sending the entire cert in a status or validity 
> query.  At a
> previous employer it became pretty clear (with a patent 
> attorney) that this
> violated a patent held by Micali. No, I don't remember the 
> number. But it was
> a good thing that the OCSP syntax changed from the -02 draft. :)
> 
> As for what identifiers to use, I always thought that 
> requiring the issuer's
> cert was onerous, and that sending the hash "for space 
> reasons" was a bogus
> argument. I further agree with Gutmann that it required weird 
> indices on the
> part of many implementors.
> 
> I always thought {Issuer-DN, Subject-DN, Serial#} was 
> relatively short and to
> the point and unique.
> 	/r$
>

---

From: Michael Ströder <[email-masked]>
Date: Fri, 17 Nov 2000 08:20:52 +0100

> unique? Is this an example of reality not agreeing with theory?

As I understand it Denis pointed out that this might not be unique
in case of a issuer key compromise (and the issuer DN being reused
in the new issuer cert).

IMHO it should be forbidden to reuse the issuer DN in this serious
case anyway.

Ciao, Michael.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 28 Nov 2000 19:11:36 -0500

>IMHO it should be forbidden to reuse the issuer DN in this serious

It's probably not reasonable to require a CA to change its name under 
such circumstances, although they might want to do so for PR purposes 
:-)

Steve

---

From: "D.K. Smetters" <[email-masked]>
Date: Tue, 28 Nov 2000 18:10:04 PST

While you might have to live with a CA keeping the same DN, you
might certainly expect them not to issue certs that repeat previously-
used serial numbers... 

--Diana