Subject: Re: TR: Request change in son-of-rfc2633

From: [email-masked] (Peter Gutmann)
Date: Wed, 29 Oct 2003 22:33:37 +1300

"Alberti Antoine" <[email-masked]> writes:

>Actually, I even wonder what guarantees that a iAndS is unique, as, as far as
>I know, there is no unique LDAP repository (or anything else) for DNs, and
>each one is only unique in the issuer's scope. By chance, it seems that the
>whole system finally works, but mathematically, it does not: 2 different CAs
>may issue 2 CA certs with the same subjectName, and these CAs may issue 2
>certs with the same serial.

Well, firstly, X.500 theology requires that you believe that all (CA) DNs are
unique, and to even claim otherwise is treason punishable by limb
reconstruction.  In any case even if you do run into a situation where two CAs
choose to use the same DN, the chance of the serial numbers (a 128-bit or 160-
bit random hash value in most cases) matching as well are... slim.

Peter.

---

From: "Tony Capel" <[email-masked]>
Date: Wed, 29 Oct 2003 10:34:37 -0500

> Actually, I even wonder what guarantees that a iAndS is unique, ...

 "Peter Gutmann" writes:
| 
| Well, firstly, X.500 theology requires that you believe that 
| all (CA) DNs are unique, and to even claim otherwise is 
| treason punishable by limb reconstruction.  In any case even 
| if you do run into a situation where two CAs choose to use 
| the same DN, the chance of the serial numbers (a 128-bit or 
| 160- bit random hash value in most cases) matching as well 
| are... slim.
| 

And also hopefully we are all practicing safe root certificate use.
We are only installing trust roots for domains that conform to our
security policy - this including appropriate obeisance to X.500
theology on the assignment of DN's (and the issue of cross certs).
Of course with root certs being downloaded as part of operating
system updates, many of us may be relying on the os vendor to do
that .....

Tony