Subject: Local regulations about PI's codification

From: "Roberto Opazo Gazmuri" <[email-masked]>
Date: Wed, 30 Jan 2002 17:41:53 -0300

Hello,

I want to thank the people ho answered my previous e-mail titled ‘"Subject
Alternative Name" v/s "Subject/Serial Number"’. Now we have a little list of
Local Solutions for the problem of putting a Permanent Identifier in a
certificate. At the end of this e-mail I am sending you a summary.

It gets the attention to see that there is only 1 equivalent solution
(Sweden and Finland) and that gives Denis Pinkas a powerful base to say “I
believe that it is time to progress the Permanent Identifier draft”.

The purpose of this e-mail is to put order in the information we are
receiving and to ask you an effort to provide more information because the
list of real examples is too short. Just 6 countries!

What is going on in the States?

And what about Spain?

I offer my self to administrate the collected information and send to the
list a new summary when new information available justifies that.

I think we should not waste time looking at individual CA’s solutions,
because a local regulation is a much stronger reference and there are to
many CA’s out of control.

Best regards,

Opazo, Roberto ([email-masked])
CEO - www.acepta.com
Certification Authority for Chile

This is the first summary and format proposition about this information...

---------------------------

Summary’s Date: January 30, 2002.
Local regulations about PI’s codification

1.- Australia
PI: Australian business number (ABN), it is a PI for companies.
Codification:
  privateExtension(1.2.36.1.333.1) = ABN
Local authority:
  Australian Government
IETF Information provider:
  Richard Culshaw [[email-masked]]

2.- Chile
PI: Rol Unico Nacional (Run)
Codification:
  subjectAltName[i].otherName[1].RunOID = run
Local authority:
  Now: Service of Internal Taxes
  Probably soon: The Ministry of Economy
IETF Information provider:
  Roberto Opazo [[email-masked]]

3.- Finland
PI: Person number (person-number)
Codification:
  subject.serialNumber= person-number
Local authority:
  ?
IETF Information provider:
  Anders Rundgren [[email-masked]]

4.- Hong Kong
PI: Hong Kong Identifier (HKID), the HKID is by law "private data".
Codification:
  subjectAltName[1].dNSName = SHA-1( RSA_PrivateKey( SHA-1( HKID ) ) )
Local authority:
  Government, Hongkong Post
IETF Information provider:
  Al Arsenault [[email-masked]]

5.- Italy
PI: Codice Fiscale (CodiceFiscale)
Codification:
  subject.CN = LastName/FirstName/CodiceFiscale/CertificateNumber
Local authority:
  ?
IETF Information provider:
  ARBIA Sig. Stefano [[email-masked]]

6.- Sweden
PI: person-number
Codification:
  subject.serialNumber= person-number
Local authority:
  The Swedish standard SS614331
IETF Information provider:
  Anders Rundgren [[email-masked]]
  Henrik Ståhl [[email-masked]]

---

From: Stefan Santesson <[email-masked]>
Date: Thu, 31 Jan 2002 02:17:58 +0100

Lets not mix technical solutions with legal concepts for assigning national 
ID-codes.

I would suggest a vocabulary where we clearly separate technical concepts 
as PI, Serial number (and other potential candidates) from national 
concepts of civic registration codes for individuals and organizations.

The terminology used here implies that inclusion of a civic registration 
code requires the PI solution, which is not true.
With regard to technical concepts I see mainly 2 solutions which I would 
point out, might be one to much since they work very similar.

1) Serial number in the subject field. This field can hold any type of 
registration code. If you want to define the semantics of this attribute 
there is a solution to assign a semantics OID and name the registration 
authority, defined in RFC 3039 section 3.2.5.1

2) a PI according to the PI draft, stored in subject Alt Name, where you 
can define semantics and registration authority through an OID and attach 
the identifier to it.

2 solutions to one problem.

I would prefer to reduce them to 1.

Maybe its time to evaluate and review RFC 3039 before we create a new CMC 
versus CMP situation.
I have some defect reports noted on RFC 3039 that ought to be fixed anyway.

Just a thought.

/Stefan

---

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 31 Jan 2002 13:52:18 +0100

Hi Stefan,
Whatever the solution becomes, I don't want it to be bound to 3039 as there
are other certificate classes like organization-certificates that has the same
need.

The PI-draft as it stands today does not take this in account.

Anders

----- Original Message -----
From: "Stefan Santesson" <[email-masked]>
To: "Roberto Opazo Gazmuri" <[email-masked]>; "PKIX (Grupo de la IETF)" <[email-masked]>
Cc: "Stephen Kent" <[email-masked]>
Sent: Thursday, January 31, 2002 02:17
Subject: Re: Local regulations about PI's codification

Just a thought.

/Stefan

At 17:41 2002-01-30 -0300, Roberto Opazo Gazmuri wrote:

>Hello,
>
>I want to thank the people ho answered my previous e-mail titled '"Subject
>Alternative Name" v/s "Subject/Serial Number"'. Now we have a little list of
>(Sweden and Finland) and that gives Denis Pinkas a powerful base to say "I
>believe that it is time to progress the Permanent Identifier draft".
>
>I think we should not waste time looking at individual CA's solutions,
>many CA's out of control.
>
>Best regards,
>
>Summary's Date: January 30, 2002.
>Local regulations about PI's codification
>
>
>1.- Australia