Subject: Re: New other certs extension I-D

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 8 Jan 2008 11:27:07 +0100

Stephen,

It seems that your concern might be solved using RFC 4043: Permanent Identifier.

   The permanent identifier is an optional feature that may be used by a
   CA to indicate that two or more certificates relate to the same
   entity, even if they contain different subject name (DNs) or
   different names in the subjectAltName extension, or if the name or
   the affiliation of that entity stored in the subject or another name
   form in the subjectAltName extension has changed.

      id-on-permanentIdentifier   OBJECT IDENTIFIER ::= { id-on 3 }
        PermanentIdentifier ::=     SEQUENCE {
           identifierValue    UTF8String             OPTIONAL,
                           -- if absent, use a serialNumber attribute,
                           -- if there is such an attribute present
                           -- in the subject DN
           assigner           OBJECT IDENTIFIER      OPTIONAL
                           -- if absent, the assigner is
                           -- the certificate issuer
   }

Your proposal is along the following:

 OtherCertificates ::= SEQUENCE OF IssuerAndSerialNumber

It would not permit an unambiguous link, since it does not address the case of two CAs 
that would bear the same name.

Denis

=====================================================

>Hi all,
>
>A problem came up in another forum of how to
>link together various certs belonging (or that
>belonged) to the same end entity. Without some
>additional naming rules beyond 3280 that can
>be tricky so I've written up a one-page-plus-
>boilerpate I-D [1] describing a possible general
>approach.
>
>I don't know if this should or should not
>be a PKIX WG item, but would welcome comments
>(in particular if there's a better way to
>solve the problem with some current extension).
>
>Regards,
>Stephen.
>
>[1] http://www.ietf.org/internet-drafts/draft-farrell-pkix-other-certs-00.txt
>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 08 Jan 2008 11:39:09 +0000

Hi Denis,

> It seems that your concern might be solved using RFC 4043: Permanent Identifier.

Certainly worth noting that as a possibility, but I guess I'd have
some concerns:

- I don't think there's a technical need for a permanent identifier for
  this purpose (as I understand it N-R is the main motivator for 4043)
- I'm not sure that there are any real assigner authorities and
  depending on a new name space might just make the problem at hand
  worse
- I've no idea whether 4043 is widely supported or not (mind you, the
  proposed new extension isn't even implemented so that's less of a
  concern)

However, I do agree that were 4043 used, it could solve the problem
at hand, so even if the new extension does go ahead, the spec should
call that out.

> that would bear the same name.

Steve K. made a related comment, so if/when I do a -01 I'll likely
change that to use the OCSP or SCVP structure that can link to
the cert via a hash as well.

Cheers,
S.