Subject: RE: Globally unique DNs - Why?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 4 Feb 2002 07:44:07 -0800

> List,
> In certain, rather "animated" discussions, the statement that an
> X509.v3 Subject DN (if specified) must be globally unique in order
> to be "conformant".

That statement is illogical.

If we have a name A that is in a subject DN and someone else decides
to use the name A then according to the statement made both DNs would
then be non-conformant.

This would mean that someone could perform a non-conformance attack on
any certificate they chose which recalls Deep Thought's ripost to 
Broomfondle "And who would that inconvenience?"

If X.400 mail was likely to suplant SMTP the issue of unique names 
would be relevant and a solution would have been found. As it is
not, no solution is needed.

	Phill

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 4 Feb 2002 22:59:47 +0100

Thanx Phill,
I was also hoping that this was a technically incorrect statement
[not only that it gramatically got a bit weird :-)]

We do though have a practical problem with RPs that handle certificates
from a multitude of CAs that also may issue a multitude of
certificate-types.  I.e. spanning potentially n*m disjunct (and in a few cases
shared), name-spaces.

Therefore I suggested a small XML-schema-inspired X509 "patch", in my reply
to Steve, to reduce name-space hassles a bit.

cheers,
Anders

----- Original Message ----- 
From: "Hallam-Baker, Phillip" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>; <[email-masked]>
Sent: Monday, February 04, 2002 16:44
Subject: RE: Globally unique DNs - Why?

Phill