Subject: Comments on draft-ietf-pkix-sonof3039-02

From: Denis Pinkas <[email-masked]>
Date: Thu, 06 Nov 2003 19:10:51 +0100

Tim, Magnus and Stephan,

I have several MAJOR concerns:

I wonder if the title of this document is still appropriate:
"Qualified Certificates Profile"

The scope is now (extract from the abstract):

    This document forms a certificate profile, based on RFC 3280, for
    identity certificates issued to physical persons.

A more appropriate title would now be:

"Profile for identity certificates issued to physical persons"

There has been much confusion from the origin with the title which is 
ambiguous because some people think it is only related to Qualified 
Certificates according to the European Directive on Electronic Signatures, 
while some others think the opposite. It is now clear that the document does 
not only relate to this European Directive, hence why a change is the title 
is needed.

The wordings "qualified certificates" and "Qualified Certificates" should be 
dropped from the document.

There is other argument where an implementation conforming to this profile 
would not conform anymore to this European Directive. The issue relates to 
the ability to identify the country where the CA is located using the 
country attribute of the DN, if DCs are used.

The other MAJOR issue has to do with the text about the DS and NR bits.

I am asking Steve Kent as co-chair (since Tim Polk is one of the co-editors, 
I cannot ask him), to freeze this document until a "clarification" about the 
meaning of these two bits is agreed at the ISO level and reflected in a 
draft of son-of-RFC3280.

Finally, since I am also part of the ETSI ESI group dealing with Qualified 
certificates, I can provide my personal view on this matter: there is no 
need to issue a new document for RFC 3039. We need some stability.

So the final question would be whether this proposed document replaces or 
not RFC 3039. If it gets a different title, then we have no need to make RFC 
3039 obsolete when/it this document is published.

Since I will not be at the Minneapolis meeting, I would appreciate that my 
position is mentionned when this point will be discussed.

Denis

---

From: Stephen Kent <[email-masked]>
Date: Thu, 6 Nov 2003 15:20:47 -0500

Denis,

Your comments are duly noted.  Steve Bellovin and I corresponded on 
this topic earlier today and agreed to wait until after the PKIX WG 
meeting next week before the IEGS would consider the document.

Stefan, please examine Denis' comments and respond by then.

Thanks,

Steve