Subject: RE: Comments on draft-ietf-pkix-sonof3039-02

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 6 Nov 2003 21:46:37 -0000

This whole thing is a misunderstanding.

Son of RFC 3039 has yet to go through WG last call.
It has not been requested to be considered by IESG by the authors.

/Stefan

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Stephen Kent
> Sent: den 6 november 2003 21:21
> To: Denis Pinkas
> Cc: pkix
> Subject: Re: Comments on draft-ietf-pkix-sonof3039-02
> 
> 
> Denis,
> 
> Your comments are duly noted.  Steve Bellovin and I corresponded on
> this topic earlier today and agreed to wait until after the PKIX WG
> meeting next week before the IEGS would consider the document.
> 
> Stefan, please examine Denis' comments and respond by then.
> 
> Thanks,
> 
> Steve

---

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 6 Nov 2003 21:56:50 -0000

Denis,

I see that you have 2 objections and 1 concern,

The document title, key usage and whether it would obsolete RFC 3039.

The title is of minor interest right now. If the community would like to
change it then fine by me. Personally I think it would be a mistake and
not worth the trouble and confusion though.

It MUST however obsolete RFC 3039. We can't have both out there defining
the same extensions, attributes and semantics

Last, this document does NOT deal with the meaning of the key usage
bits. I suggest you take that discussion in relation with ITU X.509 and
RFC 3280 where that is handled.

Recommendations on which key usages to use relative to EU Qualified
Certificates is handled by ETSI TS 102280 and should be discussed there.
I see no value to regulate that in this profile.

I'm sorry that you won't be in Minneapolis for a face to face dialogue
on this.

/Stefan

> On Behalf Of Denis Pinkas
> Sent: den 6 november 2003 19:11
> To: pkix
> Subject: Comments on draft-ietf-pkix-sonof3039-02
> 
> 
> Tim, Magnus and Stephan,
> 
> I have several MAJOR concerns:
> 
> I wonder if the title of this document is still appropriate:
> "Qualified Certificates Profile"
> 
> The scope is now (extract from the abstract):
> 
>     This document forms a certificate profile, based on RFC 3280, for
>     identity certificates issued to physical persons.
> 
> A more appropriate title would now be:
> 
> "Profile for identity certificates issued to physical persons"
> 
> There has been much confusion from the origin with the title which is
> ambiguous because some people think it is only related to Qualified
> Certificates according to the European Directive on Electronic
Signatures,
> while some others think the opposite. It is now clear that the
document
> does
> not only relate to this European Directive, hence why a change is the
> title
> is needed.
> 
> The wordings "qualified certificates" and "Qualified Certificates"
should
> be
> dropped from the document.
> 
> There is other argument where an implementation conforming to this
profile
> would not conform anymore to this European Directive. The issue
relates to
> the ability to identify the country where the CA is located using the
> country attribute of the DN, if DCs are used.
> 
> The other MAJOR issue has to do with the text about the DS and NR
bits.
> 
> I am asking Steve Kent as co-chair (since Tim Polk is one of the co-
> editors,
> I cannot ask him), to freeze this document until a "clarification"
about
> the
> meaning of these two bits is agreed at the ISO level and reflected in
a
> draft of son-of-RFC3280.
> 
> Finally, since I am also part of the ETSI ESI group dealing with
Qualified
> certificates, I can provide my personal view on this matter: there is
no
> need to issue a new document for RFC 3039. We need some stability.
> 
> So the final question would be whether this proposed document replaces
or
> not RFC 3039. If it gets a different title, then we have no need to
make
> RFC
> 3039 obsolete when/it this document is published.
> 
> Since I will not be at the Minneapolis meeting, I would appreciate
that my
> position is mentionned when this point will be discussed.
> 
> Denis
>

---

From: Stephen Kent <[email-masked]>
Date: Thu, 6 Nov 2003 17:01:20 -0500

>It has not been requested to be considered by IESG by the authors.

Stefan is right.  My error. I was thinking of the Logotype I-D.

Sorry,

Steve