Subject: Re: CERTSTORE's 160 bit limit + PI

From: [email-masked] (Peter Gutmann)
Date: Tue, 28 Jan 2003 17:07:42 +1300

[CCd back to the list in case other people have comments on this]

"Anders Rundgren" <[email-masked]> writes:

>Maybe it could be an idea to have a paragraph saying this obvious [:-)]
>thing.   Particularly since you impose so strict restrictions on the binary
>items.

Done:

  Further details of URI construction, size limits, and other details are
  given in [RFC2068].

>May I propose an additional textual attribute? "pi" A permanent identifier.
>There is quite a bunch of certificates that do not feature email addresses.
>Some 15 million only in Scandinavia.

Hmm, that's kind of a special-case identifier, and opens the door to everyone
wanting to have their own pet value included in the draft.  How about allowing
a private namespace starting with 'x-', or something similar?  This has been
done before with users who wanted special-case IDs, for example one COI-based
PKI which needed to look up certs by healthcare ID (the primary key in all of
their databases) did this.  It's a one-line addition to the interface code for
anyone who wants COI-specific IDs.  I'll include something in the
implementation notes section on this:

  In some cases users may require additional, application-specific attribute
  types.  For example, a healthcare application that uses a healthcare ID as
  the primary key for its databases may require the ability to perform
  certificate lookups based on this healthcare ID.  The formatting and use of
  such application-specific identifiers is beyond the scope of this document,
  however they should begin with 'x-' to ensure that they don't conflict with
  identifiers that may be defined in future versions of this specification.

Peter.