Subject: Re: Use of localityName attribute

From: [email-masked]
Date: Tue, 6 Jul 1999 13:00:18 -0400

Serious comments, with some others, below.  Comments with my name in
brackets are mine, with leading ">>" are David Chadwick's, and with no prefix
are Anders'.

          Tom Gindin

"Anders Rundgren" <[email-masked]> on 07/03/99 05:20:37 PM

To:   [email-masked], "Petra Gloeckner"
      <[email-masked]>
cc:   "PKIX-List" <[email-masked]>, "Stefan Santesson" <[email-masked]>
      (bcc: Tom Gindin/Watson/IBM)
Subject:  Re: Use of localityName attribute

(snip)
#2:
In many implementations (like yours) both an organization and
an individual within that organization must be unambiguously defined.

As it is already a hard task to uniquely identify an organization, it deserves
a certificate of its own.  And to build identity on local addresses is a bad
idea
as for instance my own company just moved a couple of blocks and we
are still known as the Swedish company "Jaybis AB" with registration
number 564567-1267.  If you need to know the address of an organization
you should look in a public registry (assuming it is legally registered) and not
in a certificate.

[Tom Gindin]   Locality is often part of the uniquely identifying set of
information for a legally registered organization, and thus needs to go into
some such certificates.  How about some wording such as the following:
StateOrProvinceName and/or localityName SHOULD be included in the subject and
issuer name only when the organization or organizationalUnit is legally
registered as possessing a unique right to the specified organizational name
within the state or locality specified.

>> I need to request a change to the qualified certificate draft to allow
>> the use of the localityName attribute to be used to unambiguously
>> identify a subject and issuer in a DN. The UK National Health
>> Service Standard for Directory Services requires the use of locality
>> name to unambiguously identify different organisational units within
>> the NHS. For example, there are literally dozens of St Mary's
>> Hospitals within the UK NHS, so that O and OU are insufficient as
>> differentiators. Consequently localityName, based on the UK Post
>> Office defined localities, is used to differentiate between them (we
>> do not use the full postal address as this is too cumbersome.)

[Tom Gindin]   In the particular case of hospitals in the NHS I'm somewhat
dubious about putting the locality into the subject or issuer name rather than
adding an extra OU.  After all, "St. Mary's of Bethlehem" is not in Bethlehem.
Perhaps we are all there anyhow (Bedlam, not Bethlehem) :-)

>>
>> As the QC draft stands at the moment, (as I read it), the use of
>> localityName as currently defined by the NHS would not be allowed
>> as a differentiator.
>>
>> The offending sections are:
>>
>> 3.1.1 Issuer -  allows for state or province name but not for
>> localityName. We request that localityName be added to this section.
>>
>> 3.1.2 Subject - allows postalAddress but not localityName and states
>> "Other attributes may be present but MUST NOT be necessary to
>> distinguish the subject name from other subject names within the
>> issuer domain."
>>
>> This effectively precludes localityName from being used to
>> unambiguously differentiate between hospital. We request that
>> localityName be added to the MAY list.
>>
>> Regards
>> David

---

From: "David Chadwick" <[email-masked]>
Date: Sat, 10 Jul 1999 00:14:46 +0100

From:           	[email-masked]

> information for a legally registered organization, and thus needs to go
> into some such certificates.  How about some wording such as the
> following: StateOrProvinceName and/or localityName SHOULD be included in
> the subject and issuer name only when the organization or
> organizationalUnit is legally registered as possessing a unique right to
> the specified organizational name within the state or locality specified.

I dont have a problem with that wording for organisations but for org 
units that are in the DIT below their parent organisation (like o=NHS) 
and also beneath a locality then legal registration is not relevant. 
Legal registration would be relevant if the OU was in the DIT directly 
below county and locality and your wording would be correct for this 
situation. But your proposed wording makes this implicit assumption 
without stating it, and I believe that it does not hold true for all 
situations.

David

***************************************************

David Chadwick
IT Institute, University of Salford, Salford M5 4WT
Tel +44 161 295 5351  Fax +44 161 745 8169
*NEW* Mobile +44 790 167 0359 *NEW*
Email [email-masked]
Home Page  http://www.salford.ac.uk/its024/chadwick.htm
Understanding X.500  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string MLJ9-DU5T-HV8J

***************************************************