Subject: Re: pkix-pi-10 - Split Identity++

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 22 Jul 2004 21:58:59 +0200

Although I triggered the (un)deprecation of serialNumber as PI
value objects, I am still not completely satisfied with the result.

Consider the following PI-enabled citizen certificate:

    CN=John Smith, serialNumber=6756565, C=US
    PI-assigner: 2.4.4.282.2

I believe this would make more sense:

    CN=John Smith, serialNumber=6756565, O=http://registry.us.gov, C=US

Apart from pure esthetics, an advantage of putting the assigner in the DN as
well, is that the DN becomes a TRUE SUPERSET of PI.  Using URIs,
DNs in PI-augmented certificates also become TRUE globally unique
identifiers (GUIDs).

Having one "half" of the identity in the DN and the other half somewhere
else, is IMHO not a very "clean" solution.   No other PKI name constructs
are designed that way AFAIK.

Anders R

P.S. I did not bother with describing the PI extension in the second
case as I would like to begin with the important stuff first D.S.