Subject: Re: draft-ietf-pkix-pi

From: "Tom Gindin" <[email-masked]>
Date: Fri, 1 Feb 2002 09:55:00 -0500

Massimiliano:

      I agree with Al's point about the hash (that a hash solely on ID
numbers is too weak to be very valuable).  Also, the type of identifierDesc
would probably be better as DirectoryString or PrintableString than as
Name, which is the type for a DN.
      Your point about what the CA is certifying is correct, of course.
However, it should be pointed out that cross-CA comparisons of PI's are
valid if both CA's do their jobs correctly, although responsibility for a
false match could not be determined by automated procedures.

            Tom Gindin

Massimiliano Pala <[email-masked]>@mail.imc.org on 01/31/2002
05:56:53 AM

Sent by:    [email-masked]

To:    [email-masked]
cc:
Subject:    draft-ietf-pkix-pi

Hi all,

I have some points I'd like to highlight about the PI. Current comments are
made against the http://www.imc.org/draft-ietf-pkix-pi.

First of all some general considerations. My personal point on the PI is
that this should be used only within the subjectAltName ext. and this to
prevent the Subject DN from ever growing and keep as human readable as
possible. I know that there could be established policies following the
Subject DN's but I support this option.

Let's get through the draft in order.

I would change the paragraph:

<< A permanent identifier is a name assigned by an organization,
   unique within that organization, that singles out a particular
   individual from all other individuals.  A CA which includes such
   an identifier in a certificate is certifying that any different
   public key certificate containing that identifier refers to the
   same individual. >>

Adding a phrase to clearly state that the "public key certificate..."
is from the CA in subject, something like:

<< A permanent identifier is a name assigned by an organization,
   unique within that organization, that singles out a particular
   individual from all other individuals.  A CA which includes such
   an identifier in a certificate is certifying that any different
   public key certificate issued by that CA and containing that
   identifier refers to the same individual. >>

I would like to extend the structure of the PersonalIdentifier to
something like this:

   PermanentIdentifier ::=     SEQUENCE {
           assignerAuthority        GeneralName OPTIONAL,
           identifierDesc           Name,
           identifierValue          IdentifierValue }

   IdentifierValue ::= CHOICE {
           permanentId        [1]       Name,
         permanentIdHash      [2]       IDHash }

   PermanentIdHash ::= SEQUENCE {
           identifierHash         OCTET STRING,  --- original identifier's
Hash
         identifierHashAlgorithm  AlgorithmIdentifier }

(there can be errors as I am not a master in structure definition :-D )

This structure (if correct) could solve problems tied to different current
situations, indeed there is the possibility to hide the "real" assigned ID
using the hash value instead. Usage of the Hash instead of the "real" ID
is therefore clearly stated when used. (this could be required if the
original
value carries sensible data like date of birth, etc... ).

The identifierDesc field is used to give a text identifier of the id used,
i.e. "RUN" or "ABN", depending on the description adopted by the
assignerAuthority
(I am not sure if this could be coded using different techniques, if so,
please,
point it out - thanks).

I'd also change the word "responsible" when talking about the
assignerAuthority some paragraph behind: this to state that this field
carries an indication not directly stated by the assignerAuthority's
subject (it is no liable for the contents of the field).

It could also be simply stripped off, something like:

<< The assignerAuthority field of this attribute, when present,
   identifies the organization assigning the content of the identifier
   field. When the assignerAuthority field is missing, the assignee
   Authority is the CA itself and it is assumed  to be the issuer
   name of the certificate. >>

Some comments ? Denis ?

--

C'you,

      Massimiliano Pala

--o-------------------------------------------------------------------------

Massimiliano Pala [OpenCA Project Manager]               madwolf at
cpan.org
                                                       madwolf at
openca.org
http://www.openca.org                             madwolf at
hackmasters.net
http://openca.sourceforge.net                    Mobile: +39 (0)347 7222
365