Subject: Re: "Subject Alternative Name" v/s "Subject/Serial Number"

From: Henrik Ståhl <[email-masked]>
Date: Sun, 27 Jan 2002 21:31:18 +0100

Hello Roberto,

The Swedish standard SS614331 describes the content of
certificates used in "electronic ID" smart cards. It
suggests that the national identity number be put in the
subject name field, as a serial number. Thus, a Swedish
citizen could have a certificate with a name of the form:

C=SE,surname=Anders,givenName=Johansson,serialNumber=691228-0378

The only widespread uses I have seen for the subjectAltName
extension has been in S/MIMEv3, where the e-mail address
of the subject is stored as a rfc822Name, and in some
IPSEC certificates, where the IP address is stored
there. While it would maybe be logical for a SSL server
certificate to have the URI in subjectAltName, all
implementations I have seen instead uses the common
name part of the subject name to store the name of the
server.

If you would like a copy of the standards document,
or a few example certificates, I would be happy to
provide you with them.

Henrik Ståhl
Omegapoint AB

---

From: "Al Arsenault" <[email-masked]>
Date: Sun, 27 Jan 2002 21:13:39 -0500

And for something completely different: :-)

The Government of Hong Kong wanted to include the Hong Kong Identifier
(HKID, a unique string assigned to each authorized resident of the SAR) in
certificates.  But, the HKID is by law "private data"; its use or disclosure
outside of carefully delineated circumstances is a violation of law. So
putting the ID in the certificate was a non-starter - certificates are
public data.

So how did they do it?  Check out

http://www.hongkongpost.gov.hk/5digital/dc4_fr.html

Specifically, the details are given in footnote 6 on page 48  of the 27
August 2001 CPS.

(Disclaimer: I had nothing to do with developing that solution, I just wind
up using it.  There are lots of interesting issues with this solution -
probably enough to fill a book - but I point it out as an example of a
Government attempting to solve the type of problem about which Roberto
asked.)

        Al Arsenault
        Chief Security Architect
        Diversinet Corp.

---

From: Tomas Gustavsson <[email-masked]>
Date: Mon, 28 Jan 2002 11:04:53 +0100

And in the meantime meantime, we were actually hoping the trend with 
stuffing anything into the DN would be over soon...