Subject: Re: meeting minutes uploaded

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 7 Dec 2007 09:49:16 +0100

Steve,

I was not present at the meeting, but I believe that the text of the minutes should be amended.

It is proposed to say:

" we will respond that PKIX agrees that the DR320 comments are accurate, 
and that the IETF has no plans to create a clearing house for CA names, 
nor to create standards that will recommend checks for CA name uniqueness". 

The sentence " PKIX agrees that the DR320 comments are accurate" should be deleted.

In particular, the response from ITU-T to the DR states:

"The standard takes an axiomatic view of the concept that a distinguished name unambiguously 
identifies a single entity".

I do not believe that PKIX shares the same axiomatic view.

The response from ITU-T to the DR also states:

" We believe that if two entities present the same name and 
a CA issues a certificate to each, that CA made a mistake - not a naming 
authority mistake, since a CA is not an naming authority (although one entity can be both), but an 
entity to key binding mistake that leads to confusion and even worse, a security risk".

I do not believe that PKIX would agree with such a sentence.

I believe that the minutes should simply say:

" we will respond that the IETF has no plans to create a clearing house for CA names, 
nor to create standards that will recommend checks for CA name uniqueness". 

Denis

===============================================================

>
>Please review and send comments to me by 12/19.
>
>http://www3.ietf.org/proceedings/07dec/minutes/pkix.htm
>
>Thanks,
>
>Steve
>
>

Regards,

Denis Pinkas

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 7 Dec 2007 09:37:53 -0800

>I do not believe that PKIX shares the same axiomatic view.

I read the DR as meaning that X.509 has the axiomatic view. I do not 
read the statement that we agree with them as saying we think applies 
to PKIX.

>I do not believe that PKIX would agree with such a sentence.

Same as above.

>nor to create standards that will recommend checks for CA name uniqueness".

It is better to have the reflect what was actually said in the WG meeting.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Kemp, David P." <[email-masked]>
Date: Fri, 7 Dec 2007 13:58:29 -0500

RFC 3280 says that PKIX *does* agree with the second X.509 axiom, i.e.
that a CA MUST NOT issue the same DN to two different entities:

   Where it is non-empty, the subject field MUST contain an X.500
   distinguished name (DN).  The DN MUST be unique for each subject
   entity certified by the one CA as defined by the issuer name field.
   A CA MAY issue more than one certificate with the same DN to the same
   subject entity.

The minutes should reflect what was said in the meeting, but in this
case should also acknowledge that PKIX is in agreement with X.509 on the
second point.  Saying that the IETF will not operate a global naming
authority for the Directory Name space (even though it does operate one
for the DNS Name space) does not mean that individual CAs are released
from responsibility of ensuring name uniqueness within their own
subscriber populations.  There is no point in even having a PKI if it
can't do that.

Dave

-----Original Message-----
From: Paul Hoffman

Same as above.

>nor to create standards that will recommend checks for CA name
uniqueness".

It is better to have the reflect what was actually said in the WG
meeting.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 8 Dec 2007 08:25:42 -0800

>second point.

There was not agreement in the room "that PKIX is in agreement with 
X.509 on the second point", so the minutes should not acknowledge 
that. If you want the WG to acknowledge that, you need to propose new 
text and get agreement on it. The minutes of the meeting reflect what 
was said, not the final agreement.

--Paul Hoffman, Director
--VPN Consortium

---

From: Stephen Kent <[email-masked]>
Date: Mon, 10 Dec 2007 09:27:41 -0500

Denis,

Stefan, Tim, Sam, Russ and I are coordinating a formal response. 
Once we have internal agreement on the text, we will post it to the 
PKIX list for final review.

The minutes accurately reflect what was said at the meeting.

Steve

---

From: "Kemp, David P." <[email-masked]>
Date: Mon, 10 Dec 2007 11:36:17 -0500

The draft minutes currently state:

"The second issue is easier, i.e., we will respond that PKIX agrees that
the DR320 comments are accurate, and that the IETF has no plans to
create a clearing house for CA names, nor to create standards that will
recommend checks for CA name uniqueness."

Denis has proposed deleting "PKIX agrees that the DR320 comments are
accurate", and quotes two comments:
  "The standard takes an axiomatic view ... that a DN unambiguously
identifies a single entity" and "if two entities present the same name
and a  CA issues a certificate to each, that CA made a mistake"

Both of those comments are accurate: X.509 is based on the first (PKIX
acknowledges X.509's belief in that axiom but does not agree with it),
and both X.509 and PKIX believe the second.

PKIX also agrees with the two participant statements: "CAs are being
deployed with names not acquired from naming authorities" and "IETF
provides no guidelines on ensuring that the names of CAs are
unambiguous".

However, PKIX cannot agree with other statements in the DR320 Liaison
request, namely: "The group believes that this is the only reasonable
solution for Distinguished Naming.  One votes for the CA of choice by
configuring it as an anchor."

If all PKIX-compliant applications had uniquely-name top-level CAs, and
each of those CAs issued names unique across its own subscribers, that
still does not ensure name uniqueness of 2nd-level CAs:

1:     Alice          Bob
2:  Carol Dave     Fred Dave

The liaison document says: "The directory group requests the IETF PKIX
group to comment on this statement.  If the statement is correct, we ask
..."

There are many statements in the liaison document, some are correct and
others are not.  Because PKIX does not agree with some of those
statements, including "this [top-level uniqueness plus local uniqueness
for lower levels] is the only reasonable solution to distinguished
naming", I agree with Denis' proposal to delete the first clause of the
IETF response, resulting in the following text for the minutes:

"The second issue is easier, i.e., we will respond that the IETF has no
plans to create a clearing house for CA names, nor to create standards
that will recommend checks for CA name uniqueness."

The minutes of the meeting need not delve into specific issues, but the
IETF response to ITU should elaborate that the problem of non-unique CA
naming remains unresolved.

Dave

---

From: Stephen Kent <[email-masked]>
Date: Mon, 10 Dec 2007 17:38:38 -0500

Dave,

>...

Right, we do not agree with the statement that top level CA 
uniqueness plus lower local uniqueness ensure global uniqueness, for 
the reasons you cite above.   The liaison document does not reproduce 
the DR. It cites specific comments from the DR and asks if we agree 
with the cited comments.  I believe the answer is that we do agree 
with the cited statements. My minutes will be revised to indicate 
that what we agree with were the statements in the ITU-T message, 
which cite specific portions of the DR.

The second issue is easier, i.e., we will respond that PKIX agrees 
that the DR 320 comments cited in the liaison message are accurate, 
and that the IETF has no plans to create a clearing house for CA 
names, nor to create standards that will recommend checks for CA name 
uniqueness.