Subject: Re: Last Call summary for draft-ietf-pkix-cert-utf8

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 12 Apr 2006 17:53:06 +0100

>Denis,

>PKIX (and X.509) standards do not assume that every CA will be aware 
>of the subject names in certs issued by any other CA. So, the phrase 
>"hat has the same or a similar visual representation of DN already 
>assigned to another entity" is asking too much relative to our 
>(other) standards. It also appears to require a CA to have knowledge 
>of rendering conventions by an unbounded number of applications in 
>every natural language.  I think that is unreasonable.

I do know that every CA cannot be aware of the subject names in certs 
issued by any other CA. So this was not the intent of the proposal.

The proposal was:

  Two different subject names might easily appear (using the same font 
  or different fonts) to have the same or close visual representations, 
  hence before assigning a subject name to an entity, CAs conforming to 
  this profile SHOULD NOT assign a subject name that has the same or a 
  similar visual representation of DN already assigned to another entity".

New proposal:

  Two different subject names might easily appear (using the same font 
  or different fonts) to have the same or close visual representations, 
  hence before assigning a subject name to an entity, *a CA* conforming to 
  this profile SHOULD NOT assign a subject name that has the same or a 
  similar visual representation of DN *that it has* already assigned 
  to another entity".

>Steve

Regards,

Denis Pinkas

---

From: "Julien Stern" <[email-masked]>
Date: Wed, 12 Apr 2006 18:32:40 +0200

On Wed, Apr 12, 2006 at 05:53:06PM +0100, Denis Pinkas wrote:
> [snip]
 
Denis,

while I do understand the intent, is the above proposal really the
solution? A "similar" representation is quite vague.
For instance, my name is "Julien Stern". I actually know someone
whose name is "Julian Stern". Trust me, these two are alreay visually
similar enough to cause confusion (and I'm not even using UTF8 here :)).

My humble opinion is that is illusory to expect a high level of
security based on human visual inspection. It seems to me that
this "visual collision" problem only stems from the fact that most
WEB based authentication schemes today use a password sent into a
(mono-authenticated) TLS channel. If bi-authenticated TLS channels were
used, this "visual collision" problem would essentially be gone.

--
Julien

---

From: "Michael Myers" <[email-masked]>
Date: Wed, 12 Apr 2006 09:37:44 -0800

I disagree with this proposal.  Negative requirements cannot be tested.

Mike

-----Original Message-----
From: Denis Pinkas
Sent: Wednesday, April 12, 2006 8:53 AM

> *a CA* conforming to this profile SHOULD NOT assign
> a subject name that has the same or a similar visual
> representation of DN *that it has* already assigned 
> to another entity".