Subject: Permanent identifier draft

From: Cotton Franck <[email-masked]>
Date: Mon, 11 Feb 2002 08:17:27 +0100

> Denis, Tom
> 
> I think the PI draft should be re-issued on the standard track, because
> these questions about naming and identifying are likely to become more and
> more important and should be discussed (cf. recent threads after Roberto
> Opazo Gazmuri's posting).
> 
> Il you re-issue the draft, maybe you will like to add an Appendix A.3.3
> covering the fact that most organizations already have an OID (and often
> several) without knowing it through the mapping between ISO-6523 and OID
> arc 1.3. For example, D-U-N-S number <N> is mapped to 1.3.60.<N>. If
> France, every enterprise has an OID derived from its 9-digit SIRENE number
> <S>, which is 1.3.2.<S>.
> 
> There are a many coding systems declared under ISO-6523 (EAN, SWIFT,
> EDIRA, ...), see
> http://xw2k.sdct.itl.nist.gov/l8/document-library/draft-standards/ICD-list
> .htm
> <http://xw2k.sdct.itl.nist.gov/l8/document-library/draft-standards/ICD-lis
> t.htm> 
> 
> Franck Cotton
> INSEE - http://www.insee.fr <http://www.insee.fr>

---

From: "todd glassey" <[email-masked]>
Date: Mon, 11 Feb 2002 08:27:38 -0800

Permanent identifier draftFrank you are 100% dead on but the same is true of many PKI protocols. 

Denis and TS Authors - The timestamp protocol has exactly the same problem and desperately needs a way to specify a variant Token Protocol and its management - Especially for tokens to represent financial transactions like in SWIFT, QUICK and FLASH. The TST is where the TSP meets the road as I have always said and the power to do and negotiate various types of TST's is the power behind the true TSA.

However if you think about it, the same is true of most PKI protocols. They may be able to manage signature-verification (which is all that pure PKI is good for), but the question is how Signatures are applied to individual data blobs for use. Its the Rules and processes that make up the Protocol per se.

Ultimately I think that ALL of the successful PKI protocols will need this same type of capability, that is to leverage services from another PKI Service, since at the application level all they are good for is decision support systems. Without significant additions in data and content assurance processes all they can be used for is by an application for verifying a signature in time as part of a larger decision support process. 

Todd Glassey.
  ----- Original Message ----- 
  From: Cotton Franck 
  To: 'Denis Pinkas' ; 'Tom Gindin' 
  Cc: [email-masked]' 
  Sent: Sunday, February 10, 2002 11:17 PM
  Subject: Permanent identifier draft

  Denis, Tom 

  I think the PI draft should be re-issued on the standard track, because these questions about naming and identifying are likely to become more and more important and should be discussed (cf. recent threads after Roberto Opazo Gazmuri's posting).

  Il you re-issue the draft, maybe you will like to add an Appendix A.3.3 covering the fact that most organizations already have an OID (and often several) without knowing it through the mapping between ISO-6523 and OID arc 1.3. For example, D-U-N-S number <N> is mapped to 1.3.60.<N>. If France, every enterprise has an OID derived from its 9-digit SIRENE number <S>, which is 1.3.2.<S>.

  There are a many coding systems declared under ISO-6523 (EAN, SWIFT, EDIRA, ...), see http://xw2k.sdct.itl.nist.gov/l8/document-library/draft-standards/ICD-list.htm

  Franck Cotton 
  INSEE - http://www.insee.fr

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 13 Feb 2002 12:11:40 +0100

Franck,

> Opazo Gazmuri's posting).

I agree.

> France, every enterprise has an OID derived from its 9-digit SIRENE number

Before doing this, while I understand that this is "technically possible", 
could you provide us with information which proves it is "legally feasible" 
to do it this way ?

I have browsed on the web pages from www.dnb.com and I was not able to find 
any information about the OID. It is important to make sure the holder of 
the organization OID is indeed willing that its tree below can be used in 
this way. The same applies for INSEE.

Looking forward for more information.

Regards,

Denis

> http://xw2k.sdct.itl.nist.gov/l8/document-library/draft-standards/ICD-list.htm
> 
> Franck Cotton