Subject: Why don't using Permanent Identifier on QC certificates?

From: Juan Carlos Pérez Aguayo <[email-masked]>
Date: Tue, 19 Dec 2000 16:25:30 -0400

In the QC draft is stated:

"...The serialNumber attribute type SHALL, when present, be used to
   differentiate between names where the subject field would otherwise
   be identical.  This attribute has no defined semantics beyond
   ensuring uniqueness of subject names.  It MAY contain a number or
   code assigned by the CA or an identifier assigned by a government or
   civil authority.  It is the CA's responsibility to ensure that the
   serialNumber is sufficient to resolve any subject name collisions..."

and on the Permanet Identifier drfat;
Sorry if this discussion has happened before, but I don't know if there are
some final statement:

"... A serialNumber attribute may be used for two
   different purposes in the DN of a person:

   1) In a DN or a SubjectAltName to differentiate between
      two names (for two different individuals) that otherwise
      would not be different.

   2) In the identifier field from a permanent identifier.
      This is the recommended use for national ID's and
      employee ID's, for example. ..."

Now, consider this:

a person has a unique identifier, assigned by a goverment authority, wich is
guaranteed to be unique on a national scope (country domain)

How to incorporate this identifier into a certificate?.

SerialNumber or SubjevctAltname field? When I read the QC profile
"..identifier assigned by a goverment o civil authority...", and then the PI
draft say "... This is recommended use for national ID's...", I am confused.

Why the QC does not use Permanent Identifier?

Thera are some application wich need incorporate this class of personal
identifier. By example, in my country (CHILE) each people ha an unique ID
stamped in a card (this card has the photography and handwritting too), and
this is broadly recognized for identification. One can to do many
transactions wich need this ID for proceed.

Thanks in advance

Juan Carlos Pérez A.
Acepta.com

---

From: Dennis Glatting <[email-masked]>
Date: Wed, 20 Dec 2000 05:49:27 -0800

Juan Carlos Pérez Aguayo wrote:
	[snip] 
> guaranteed to be unique on a national scope (country domain)

Not in the United States, at least not yet. 

In the US each person is suppose to have a Social Security Number
(SSN) however this number may not be unique as there have been cases
when the USG has handed out duplicates. It is integrated into our
birthing system that a person is assigned an SSN at birth however
births outside the system (e.g., home births) this isn't the case and
a SSN may not be obtained for years. I believe in the Federal Witness
Protection Program one can get a new SSN. Finally, I don't know if it
is true, I am told one does not have to have a SSN however the US
system is structured that you do (read: life is a hassle).

---

From: Robert Moskowitz <[email-masked]>
Date: Wed, 20 Dec 2000 09:32:42 -0500

At 05:49 AM 12/20/2000 -0800, Dennis Glatting wrote:

SSNs are a poor identity in the US.  Agreed.  The whole QC profile would 
have to be modified for use here.  The basic idea is sound but does not fit 
into our structure.  Other countries will probably now submit THEIR 
profiles to the IETF for inclusion as a standard.

For my part, I MUCH prefer the PI method to QC method (a separate attribute 
outside of the DN).  For example, the State of Michigan could get an OID 
under the US (probably has one and does not know it), then assign one to 
the Department of Motor Vehicles.  My license # now becomes a PI.  I can 
now use a MI DMV cert to assert myself for a business cert with my bank.

If you are not interested in a discussion on US SSNs, you might skip the 
rest of this message.

>when the USG has handed out duplicates.

Many people over age 60 and some over 50 have duplicate #s.  This happened 
in the 50s when wallets were sold in the US with 'sample' SSN 
cards.  People buying those wallets thought those were their number.  Most 
of these are probably out of the system by now, thanks in large measure to 
Mediare and Medicaid.

>It is integrated into our birthing system that a person is assigned an SSN 
>at birth however
>a SSN may not be obtained for years.

Only recently, since the IRS required SSNs for all dependents on the 
1040.  I remember the year that I got my 3 oldest kids their #s to comply 
with the new 1040 regs.

>I believe in the Federal Witness Protection Program one can get a new SSN. 
>Finally, I don't know if it is true,

It is.  There are other ways to get new SSNs too.

>I am told one does not have to have a SSN however the US

If you never file taxes and pay cash for medical care and avoid banks, you 
can do quite nicely without one.  Met some people in the hills of Tennessee 
some years ago.  Their family has avoided all of this since 1792....

Boy, did they make a good drink.

And no, I did not EVEN ASK to see the still.  That is why I am here to talk 
about it.

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]

---

From: Juan Carlos Perez Aguayo <[email-masked]>
Date: Wed, 20 Dec 2000 12:57:39 -0400

May be isn't a good idea to incorporate Permanet Identifier into a QC, as
Anders Rundgren did say to me:

"...If you use QC DN must be unique so you really do not have an alternative
but keep SerailNymber
and insert a redundant SerialNumber in a PI entry.

That's why I think PI is wrong. ..."

My principal concern is about how to incorporate a national ID into a
certificate, in a interoperable fashion.

I don't know how many countries has National IDs, and if is desired that
such ID could be to incorporated into a digital certificate, but in my
country (CHILE) so happen, and I wish to using a standard solution...

I think that QC is a good solution for certificates issued only a physical
people, and when a require a unique statement of identity

I like PI solution, mainly because I think that "Permanent Identifier" ia a
separate concept, and should be outer the DN, but I am concern about how
many support into the PKIX WG the PI has currently. Seem that QC has better
support today.

I am the Chief Technology Officer of a newly Certification Authority in my
country (we are currently not in production yet, but soon I hope :) ), and I
am strongly supporting "PKIX standards" for our certificates.

If you are not interested in a discussion on Chilean National IDs and
certificates, you might skip the
rest of this message.

In my country , Chile, the Civil Registry Authority issue a unique
identifier (on a national domain) on birth. This ID is put into a plastic
"identification card" (and biometrics information is on the card too). Every
citizen has a ID. This ID is used for many transactions: tax pay, obtaining
bank accounts, voting, ... Then I think that is nice to incorporate this ID
into a certificate, as a "virtual" identification card (whidauth photo and
biometrics).

The companies must to obtain a ID assigned by the authoruty too. This ID
uniquely identify the company into the country.

Which do you think that is the PI draft future support?

Thanks

Juan Carlos Perez Aguayo
CTO
Acepta.com
[email-masked]

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 20 Dec 2000 17:31:19 +0100

Juan Carlos,

> country (CHILE) so happen, and I wish to using a standard solution...

The PI is not restricted to national IDs. It also works with corporate IDs.

> people, and when a require a unique statement of identity

The choice is not between QC and PI. Originally, it has been proposed to add
PI into the QC profile. At the Pittsburgh meeting, it has been decided that
the two documents go their own way.

> many support into the PKIX WG the PI has currently. Seem that QC has better

No one yet support QCs. Then supporting QC does not necessarily means
supporting all the features described in QC. A good combination would be to
use both QC and PI. This means that the *optional* serial number used in the
DN would not usually be present as soon as the PI extension is present.

> Which do you think that is the PI draft future support?

People usually wait for the document to reach the level of a Proposed
Standard before implementing it. We are close to that stage, but not yet
there. As mentioned during the last IETF meeting, PI is a useful, but
optional, feature. 

Regards,

Denis

---

From: "Oscar Conesa" <[email-masked]>
Date: Wed, 20 Dec 2000 17:45:39 +0100

In Spain we have the same problem. Now, we use one propietary OID
(1.3.6.1.4.1.4710.1.3.1, Safelayer) in the Subject DN to codify
the spanish personal number identificaction (NIF, Numero de identificion fiscal).
We know that is not a good solution.

I think that PI is better than propietary OID.

Thanks
Oscar Conesa
Dtor Tecnico de FESTE

----- Original Message -----
From: Juan Carlos Perez Aguayo <[email-masked]>
To: Robert Moskowitz <[email-masked]>
Cc: Ietf-Pkix <[email-masked]>
Sent: Wednesday, December 20, 2000 5:57 PM
Subject: National Identifier into Serial Number or SubjectAltName? (Was: Why don't using
Permanent Identifier on QC certificates?)

---

From: "Khaja E. Ahmed" <[email-masked]>
Date: Wed, 20 Dec 2000 09:45:08 -0800

I agree with Bob that an SSN in the US is fairly dependable (for some value
of fairly) as a unique identifier among US nationals.  There probably isn't
much lost by the fact that some us nationals, like Bob's Tennessee hosts,
will not be covered by this.  I sense a distinct lack of interest in
eCommerce there.

Note however that SSNs aren't just for US nationals. Visitors and foreign
nationals on student visa or H1 (temporary work) visa are also given an SSN
in the US.  So while an SSN can be used as unique identifiers for US
nationals there is no assurance of US nationality itself.  Unless there is a
number range reserved for US nationals, alien students and workers etc.

Khaja

----- Original Message -----
From: "Robert Moskowitz" <[email-masked]>
To: "Dennis Glatting" <[email-masked]>;
<[email-masked]>
Cc: "Ietf-Pkix" <[email-masked]>
Sent: Wednesday, December 20, 2000 6:32 AM
Subject: Re: Why don't using Permanent Identifier on QC certificates?

---

From: Juan Carlos Perez Aguayo <[email-masked]>
Date: Wed, 20 Dec 2000 16:48:22 -0400

[snip]

> DN would not usually be present as soon as the PI extension is present.

I understand that SerialNumber isn't *optional*, because DN has to be
unique, if the CN isn't unique.

By example, two persons that have equal names (CN, givenName.

C= CL, O= My org, OU = my Unit, CN = Jhon Davis and National ID 123
C= CL, O= My org, OU = my Unit, CN = Jhon Davis and National ID 444

Using QC, is need to incorporate National ID into DN, for uniquiness =>
SerialNumber = 123, and SerialNumber =444

If we can using not unique DNs, we can put PI for identity uniqueness into
QC.

regards

Juan Carlos

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 21 Dec 2000 10:10:49 +0100

> C= CL, O= My org, OU = my Unit, CN = Jhon Davis and National ID 444

I would use a different example:

C= CL, O= My org, OU = my Unit, CN = Jhon Davis and serial number = 22
C= CL, O= My org, OU = my Unit, CN = Jhon Davis and serail number = 23

These two individuals are different. Their names are unique. However, their
serial numbers no NOT relate to any national identification scheme. The PI could
suport a national identification scheme or any other identification scheme.

This means that there exist cases where both the serial number from the DN and
the PI have some reason to co-exist.

Denis

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 21 Dec 2000 17:49:06 +0100

> the PI have some reason to co-exist.

Juan and Denis,

Technically possible solution yes, but inserting disambiguating nonsense serial numbers in the DN when 
you actually have a unique identity number (national or other) seems like a very odd solution. 

For migration purposes CAs will have to continue "to put the identity in the DN" essentially 
until/if PI is built into the heart of all major RP software. The current solution is to use external "mapping 
software" that extract PI-info and supply "naming authority" externally. As the number of CAs that 
a given RP is likely to support/trust is likely to be fairly limited, this makes PI somewhat redundant. 

If PI instead had been targeted to support the existing DN mapping processes instead of creating new 
places to stuff partly redundant identity information (efectively "competing with DN"), it would had been a
nicer option.

Or you can of course use the following semantics: If there is a PI - ignore DN completely.  It should
only be used for "display purposes".  I find this neither compatible with current practice nor with QC.

Anders

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 26 Dec 2000 15:24:07 +0100

Anders,

> you actually have a unique identity number (national or other) seems like a very odd solution.

The specification of a DN does NOT say that serial number by its own is
unique. It says that taking all the components of the DN, including (if
present) the serial number, makes the name unique for the CA. Unfortunately,
we are not able to change this.

> software" that extract PI-info and supply "naming authority" externally. 

You are perfectly right. But this means that the mapping can only be
application dependent.

> As the number of CAs that

Not exactly. It will avoid to do the mapping you were talking of, and thus
will allow interoperability between applications.

> places to stuff partly redundant identity information (efectively "competing with DN"), it would had been a

It has been a solution we thought of, when we started, but this would have
mandated some kind of ordering of the elements of the DNs and such an
ordering is not allowed by the standard. There was no support to amend the
standard in that direction and thus why this option has been discarded.

> only be used for "display purposes".  I find this neither compatible with current practice nor with QC.

The DN and the PI serves two different purposes: the DN is, as you say, for
"display purposes", hence for use by human beings. The PI is for use by
computers.

Thanks for your interest in the topic,

Denis