Subject: Re: Use of localityName attribute

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 7 Jul 1999 02:25:48 +0100

Tom,
Thanx for the short-version (although it still sounds complicated to me).

<large snip>
>And aren't certificates mainly intended for computers to read and interprete?
>
>[Tom Gindin]   Of course they are, but who administers the unique codes?  In
>Sweden, the answer is probably "the government".  In the USA and a number of
>other countries, there is no equally simple answer.

To me it seems natural that CAs/RAs create and maintain these codes regardless if
they denote individuals or organisations.  Such a code does not have to be unique
outside a "certificate domain" if there exists no "absolute" code like SSN (or U may not
even want to use such).  This though more or less requires CAs to be independent
commercial or government-owned to work.

As this works fine today on a fairly large global scale with DNS names and server-
certificates I see no reason why it should not work for organisations and individuals. 
That server-certificates do not contain IP-addresses is because this is an unstable
attribute of less importance, as is the address of an organization or an employment
for an individual.  In case you need such an attribute you interrogate thee true owner
rather than a TTP.

But, I will not waste bandwidth on this item [more] as I know that the idea that organizations
should create certificates seems to be a cornerstone in QC/EU-projects.  I object to that as it is not
in line with normal company business priorities to certify individuals/employees.  As long as
employees do the tasks they are supposed to they are OK to most employers!

However, if an employee starts to use his/her in-house created cert for private use, their employer puts
on a potential liability burdon they have no reason to accept.   But if individuals can't use their
certs externally what was really the point with a CA hierarky anyway?

Anders

---

From: Stephen Kent <[email-masked]>
Date: Tue, 6 Jul 1999 22:53:31 -0400

Anders,

I strongly disagree with your comments re organization certification.

Organizatiolns issues paper credentials to employees, students, customers,
etc. all the time.  It is quite logical to move these relationships to
cyberespace, through the issuance of digital certificates. Organizations
are uniquely well qualified to certify individuals in organizational
contexts! One may debate the appropriate scope of these credentials, but
there is certainly nothing inherrently wrong with organizational
certification.

Steve