Subject: RE: OCSP identifiers

From: Michael Myers <[email-masked]>
Date: Mon, 27 Nov 2000 13:33:36 -0800

Ambarish,

In the context of my response to Denis, you asked today:

> Did I miss some mails? Not sure I saw any consensus on
> changing the way of identifying the certificate at all.

I was speaking to Denis about consensus on his proposed syntax for alternate
certificate identification.  His proposal conflicts in technical detail with
the OCSPv2 authors' proposal addressing the same need.  This is something
Denis, I and my co-authors will work through in San Diego.

I was not claiming a consensus on the fundamental need to amend RFC 2560's
certificate identification syntax.  But since you brought it up, it would be
useful to tally across the "Re: OCSP identifiers" thread.  I've done so.
Among those who spoke on-list regarding OCSPv2's proposal to amend RFC
2560's certID syntax, PKIX has:

9  in favor
2  opposed

Below is the précis underlying that count.

Mike

In favor
--------
Michael Myers
Carlisle Adamas
Stephen Farrell
Rich Ankney
Denis Pinkas
   (noting that Denis proposes an alternative means
    of expanding RFC 2560's certID.)
Margus Freudenthal
   (who on 11/17 wrote in part "I would support
    including the certificate hash option as well.")
Peter Gutman
   (who on 11/16 wrote in part "I would really like
    to see this [>(Serial#, IssuerPKHash, IssuerDNHash]
    fixed [since], as I pointed out in my earlier
    message you can do something with the issuer name
    and serial number . . . [because] you can't do
    anything when one component is in a hashed form
    and the other one isn't.")
Michael Ströder
    (who on 11/16 in response to Rich Salz's observation
     "I always thought {Issuer-DN, Subject-DN, Serial#}
     was relatively short and to the point and unique."
     said "you're damn right! But this would be too
     easy... (Sigh! ;-)")
Rich Salz
    (see above)

Opposed
-------
Ambarish Malpani
Paul Hoffman

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 28 Nov 2000 14:17:18 +0100

Michael,

>     of expanding RFC 2560's certID.)

!?!?!? Please, Mike, count me on the OPPOSED side.

This makes four oppositions, if I count correctly and - maybe - eight in
favor: this is NOT a rough consensus.

Denis