Subject: Draft response to the liaison from ITU-T SG 17 to IETF on the resolution of DR320

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 23 Nov 2007 17:51:37 +0100

Stephan,

Thank you for posting the agenda.

I noticed that 3.1 is about DR 320 : 
      Liaison statements received from ITU-T SG17 - 10 min
      Stefan Santesson (WG co-chair)
      https://datatracker.ietf.org/liaison/375/

I have prepared below a draft response to the liaison statement:

Draft response to the liaison from ITU-T SG 17 to IETF on the resolution of DR320 
 
See: https://datatracker.ietf.org/liaison/375/
 
Neither DNs of entities, nor DNs of CAs, can be unambiguous.
 
Within RFC 3280, every subject DN (whether it is an entity DN or a CA DN) 
is only unique for the CA that has picked that name. A CA is thus free to choose any DN 
for naming an entity without the need to find out if that name has already been used by 
some other CA in the world. 
There is currently no mechanism in place to prevent conflict, e.g. a list of existing CA names that deployers of new CAs could check for naming conflicts. There is no need to consider putting mechanisms in place to prevent conflict, e.g. a list of existing CA names that deployers of new CAs could check for naming conflicts.
The single requirement is the following: within a validation policy or within a signature policy 
there shall not be two different root CAs (trust anchors) with the same DN. 
 
This means that within RFC 3280 an ambiguous name is composed of a sequence of DNs, 
starting with the DN of a root CA and ending with the DN (or the Subject Alternate Name, 
if the DN is empty) of the entity.
 
This also means that a DN alone associated with a certificate serial number is unable to uniquely identify 
a public key certificate. 
 
However, if the DN is the DN from a certificate issuer whose certificate has been verified under a given 
validation policy or signature policy, then that DN can be characterized by a chain of upper CA names and 
then becomes unique under that validation or signature policy.
 
The liaison statement states: "Things break if two entities identify themselves using the same name". 
No evidence has been provided by ITU-T SG 17 to demonstrate that this statement is true. 
If it were, amendments to X.509 would need to be provided to deal with name collisions 
which are indeed possible, either intentionally or by accident. 

Denis

I have updated what I believe to be the final agenda for Vancouver.
We have now an almost full 2 hour program.
 http://www3.ietf.org/proceedings/07dec/agenda/pkix.txt
 Stefan Santesson
Senior Program Manager
Windows Security, Standards