Subject: Re: [pkix] Update need to RFC 3739

From: Denis <[email-masked]>
Date: Tue, 04 Jun 2013 17:01:40 +0200

Stefan,

The latest version published at 
http://www.x500standard.com/index.php?n=Ig.LatestAvail.
is: ISO/IEC 9594-6:2008

I could not find organisationIdentifier in it.

Would you be able indicate your source and copy the text ?

Nevertheless, I wonder whether using a new attribute is really necessary.

In France, we have defined a French standard (RGS 1.0). I will provide 
an approximate translation of it:

"One instance of an attribute organizationalUnitName MUST be present and 
MUST contain the identification of the entity.
This attribute MUST be structured according to ISO 6523.

In France, the format that MUST be used is:

- the ICD (International Code Designator) using four characters,
- the character "space", and
- the identification of the organisation up to 35 characters,

As an example, for french organizations the format will be:

ICD= 0002
the character "space",
the SIREN (9 characters) or SIRET number (14 characters) as given by the 
french INSEE organisation.

If we follow this direction, then already issued certificates for french 
organisation would
already be conformant (in other words nothing would need to be changed).

The changes that would be required in RFC 3739 are much more important 
than you say, starting with the abstract:

This document forms a certificate profile, based on RFC 3280, for

identity certificates issued to natural persons.

continuing with :

-The Qualified Certificate is issued to a natural person (living

human being).

continuing with :

Of these attributes, the subject field SHALL include at least one of

the following:

ChoiceI:commonName

ChoiceII:givenName

Choice III:pseudonym

etc...

The changes are so important that I wonder that the current proposal is 
the right way to proceed.

A new RFC (or a new ETSI TS) dedicated to organisations be more appropriate.

Organisations currently delivering certificates to human beings would be 
able to continue to refer to RFC 3739
and would not need to change their documentation in order to refer to 
the latest document
(please save our money and our forests !).

Organisations that will deliver QCs to organisation units would be able 
to refer to a new RFC or a new ETSI TS.

Denis

> Denis,
>
> The content of the organisationIdentifier is an interesting question. But
> it can be done separate to the discussion of the need for an update of
> 3739.
> The organisationIdentifier is already defined in X.520, so we have no
> power over it. It is an unstructured string, much like serialNumber is,
> except it is not limited to PrintableString which is a good thing.
>
> What we need to agree on in the case of 3739 is simply to remove the
> requirement that any particular set of attributes must provide a unique
> identity, and simply accept that the unique identity is provided by the
> complete set of any attributes.
>
> /Stefan
>
>
> On 5/30/13 4:00 PM, "Denis" <[email-masked]> wrote:
>
>>   Stefan,
>>
>> Thank you for raising the issue to the list.
>> However, at the time the document was written, there was no mistake.
>>
>> In France, nobody may get a certificate representing a company or an
>> organization.
>> Thus a QC cannot be issued to an organization.
>>
>> However, a certificate could be issued to a department within an
>> organisation.
>> Thus identifying the department within the organisation (as well as the
>> organisation of course) is necessary.
>> In other words, using only an organisation identifier is insufficient.
>>
>> The point which should be discussed on the list is the content of
>> proposed "organisationIdentifier".
>> It would be interesting to know what you propose for it in principle,
>> before issuing a diff document.
>>
>> Denis
>> :
>>> Most of what got defined in RFC 3739 was good.
>>>
>>> It is a very highly deployed standard in the EU.
>>> At the time, EU defined Qualified Certificates as something that was
>>> only
>>> issued to a natural person.
>>>
>>> However, there is one requirement of RFC 3739 that was doomed to fail
>>> given enough time.
>>> And that is the required list of attributes in section 3.1.2.
>>>
>>> In particular this sentence:
>>> "Other attributes MAY also be present; however, the use of other
>>>      attributes MUST NOT be necessary to distinguish one subject name
>>> from
>>>      another subject name.  That is, the attributes listed above are
>>> sufficient to ensure unique subject names."
>>>
>>> Yes, I wrote that. And I fully admit my mistake.
>>>
>>> In particular two things have happened that makes this requirement plain
>>> wrong and obsolete.
>>>
>>> 1) EU has now concluded that QC can be issued not only to people, but to
>>> organisations.
>>> 2) X.520 has defined a new attribute for organisationIdentifier
>>>
>>> That attribute is much more suitable to use for an organisation unique
>>> identifier rather than serialNumber. Especially if the cert includes
>>> information about both a person and an organisation.
>>> So the organisationIdentifier attribute may very well be necessary to
>>> achieve uniqueness in many cases.
>>>
>>> It is nether very future proof to assume that serialNumber will be used
>>> forever.
>>> There are other more suitable attributes that you may want at times.
>>>
>>> As an example, there is a local Swedish attribute for national Swedish
>>> ID
>>> numbers used in many Swedish PKI deployments. They will never fit the
>>> attribute requirement of RFC 3739.
>>>
>>> ETSI is currently making interop profiles for QC that are not natural
>>> persons.
>>> But the EU QC profile EN 319 412-5 relies on RFC 3739.
>>>
>>> This has created a deadlock where the interop profile will have to
>>> violate
>>> RFC 3739, unless RFC 3739 is updated.
>>>
>>> I will initiate an effort to create an update RFC that opens up this
>>> requirement of RFC 3739. This will be in the form of a DIFF (OLD: NEW:)
>>> update document.
>>>
>>> I raise the issue here to get feedback. This probably has to go as a
>>> private submission, but as this list is still open, we can always
>>> discuss
>>> the issue here.
>>>
>>> /Stefan
>>>
>>>
>>> _______________________________________________
>>> pkix mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/pkix
>> _______________________________________________
>> pkix mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 04 Jun 2013 17:31:06 +0200

http://www.itu.int/rec/T-REC-X.520-201210-I!Cor3

If we want the new QC profiles of EU to confirm to RFC3739, then RFC 3739
must be updated.
That is not only caused by this attribute.

/Stefan

From:  Denis <[email-masked]>
Date:  Tuesday, June 4, 2013 5:01 PM
To:  Stefan Santesson <[email-masked]>
Cc:  <[email-masked]>
Subject:  Re: [pkix] Update need to RFC 3739

>  In France, we have defined a French standard (RGS 1.0). I will provide an
> approximate translation of it:
>  
>  "One instance of an attribute organizationalUnitName MUST be present and MUST
> contain the identification of the entity.
>  The changes that would be required in RFC 3739 are much more important than
> you say, starting with the abstract:
>  
>   
> 
>    -  The Qualified Certificate is issued to a natural person (living
>  
>       human being).
>  
>  continuing with :
>  
>   
>       Choice   I:  commonName
>       Choice  II:  givenName
>       Choice III:  pseudonym
>  The changes are so important that I wonder that the current proposal is the
> right way to proceed.
>  
>  Organisations currently delivering certificates to human beings would be able
> to continue to refer to RFC 3739
>  and would not need to change their documentation in order to refer to the
> latest document 
>  Organisations that will deliver QCs to organisation units would be able to
> refer to a new RFC or a new ETSI TS.
>  
>  Denis
>  
>  
>  
>>  
>> Denis,
>> 
>> On 5/30/13 4:00 PM, "Denis" <[email-masked]> <mailto:[email-masked]>
>> wrote:
>> 
>>  
>>>  
>>>  Stefan,
>>> 
>>>> [email-masked]://www.ietf.org/mailman/listinfo/pkix
>>>>  
>>>  
>>> [email-masked]://www.ietf.org/mailman/listinfo/pkix
>>>  
>>  
>>  
>  
>

---

From: Denis <[email-masked]>
Date: Tue, 04 Jun 2013 18:45:51 +0200

Stefan,

Thank you for the link.

The definition is:

organizationIdentifier ATTRIBUTE ::= {
   WITH SYNTAX               UnboundedDirectoryString
   EQUALITY MATCHING RULE    caseIgnoreMatch
   SUBSTRINGS MATCHING RULE  caseIgnoreSubstringsMatch
   SINGLE VALUE              TRUE
   ID                        id-at-organizationIdentifier }

This structure is insufficient, since it is too wide open (it is not a 
structured field).
The second question will be whether using organisationIdentifier would 
more appropriate or not than using organizationalUnitName.

The second point is that the only currently valid text is the EU 
Directive from 1999.

You seem to anticipate some changes. However at the present time, no 
change has been agreed by the EU MS.

There is a proposed regulation currently being discussed. I am not keen 
to make change in anticipation of a text
which has not yet been approved and which is not even public anymore.

Finally, you mention that there are other changes are needed, but I 
omitted to provide a rational.

Denis

> <http://www.itu.int/rec/T-REC-X.520-201210-I%21Cor3>
>
> If we want the new QC profiles of EU to confirm to RFC3739, then RFC 
> 3739 must be updated.
> From: Denis <[email-masked] <mailto:[email-masked]>>
> To: Stefan Santesson <[email-masked] <mailto:[email-masked]>>
> Cc: <[email-masked] <mailto:[email-masked]>>
>     In France, we have defined a French standard (RGS 1.0). I will
>     provide an approximate translation of it:
>
>     "One instance of an attribute organizationalUnitName MUST be
>     present and MUST contain the identification of the entity.
>     the SIREN (9 characters) or SIRET number (14 characters) as given
>     by the french INSEE organisation.
>
>     If we follow this direction, then already issued certificates for
>     french organisation would
>     The changes that would be required in RFC 3739 are much more
>     important than you say, starting with the abstract:
>
>     The changes are so important that I wonder that the current
>     proposal is the right way to proceed.
>
>     Organisations currently delivering certificates to human beings
>     would be able to continue to refer to RFC 3739
>     and would not need to change their documentation in order to refer
>     to the latest document
>     Organisations that will deliver QCs to organisation units would be
>     able to refer to a new RFC or a new ETSI TS.
>
>     Denis
>
>>     Denis,
>>
>>     On 5/30/13 4:00 PM, "Denis"<[email-masked]>  wrote:
>>
>>>       Stefan,
>>>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 04 Jun 2013 19:04:51 +0200

Denis,

I have limited time right now.

Since the organizationIdentifier is simply a string, you can set it to any
string value.
It will then be understood as an arbitrary identifier unless you use some
mechanism to further contrain the format.
A typical use of this attribute I foresee is an identifier from a national
company registry. But that is not mandated.

OranizationalUnitName is a bit different, as it is a name of an
organisational unit.

EU has proposed to allow legal person and web server certificates to be
issued as QC. Neither will fit the narrow attribute list of RFC 3739.
ETSI is creating cert profiles for it in the 319 412 series.

This will require an update of RFC 3739.

/Stefan

From:  Denis <[email-masked]>
Date:  Tuesday, June 4, 2013 6:45 PM
To:  Stefan Santesson <[email-masked]>
Cc:  <[email-masked]>
Subject:  Re: [pkix] Update need to RFC 3739

>  The second question will be whether using organisationIdentifier would more
> appropriate or not than using organizationalUnitName.
>  
>  The second point is that the only currently valid text is the EU Directive
> from 1999.
>  
>  You seem to anticipate some changes. However at the present time, no change
> has been agreed by the EU MS.
>  
>  There is a proposed regulation currently being discussed. I am not keen to
> make change in anticipation of a text
>  Finally, you mention that there are other changes are needed, but I omitted
> to provide a rational.
>  
>  Denis
>  
>  
>  
>>  
>>>> On 5/30/13 4:00 PM, "Denis" <[email-masked]>
>>>> <mailto:[email-masked]>  wrote:
>>>> 
>>>>  
>>>>>  
>>>>>  Stefan,
>>>>>

---

From: Denis <[email-masked]>
Date: Tue, 04 Jun 2013 19:18:58 +0200

Stefan,

A short reply.

RFC 3739 is a QC (for natural persons).

There is plenty of room for a RFC or an ETSI TS dedicated to QC for 
organisational units under the responsibility of a legal person.

Thus an update of RFC 3739 is not needed,
unless you have other arguments that have not yet been disclosed.

You said: "EU has proposed", but the reality is that EU MS have not yet 
agreed.

Denis

P.S. Please save our trees !
:
> Since the organizationIdentifier is simply a string, you can set it to 
> any string value.
> It will then be understood as an arbitrary identifier unless you use 
> some mechanism to further contrain the format.
> A typical use of this attribute I foresee is an identifier from a 
> national company registry. But that is not mandated.
>
> EU has proposed to allow legal person and web server certificates to 
> be issued as QC. Neither will fit the narrow attribute list of RFC 3739.
>     This structure is insufficient, since it is too wide open (it is
>     not a structured field).
>     The second question will be whether using organisationIdentifier
>     would more appropriate or not than using organizationalUnitName.
>
>     You seem to anticipate some changes. However at the present time,
>     no change has been agreed by the EU MS.
>
>     There is a proposed regulation currently being discussed. I am not
>     keen to make change in anticipation of a text
>     Finally, you mention that there are other changes are needed, but
>     I omitted to provide a rational.
>
>     Denis
>
>>     If we want the new QC profiles of EU to confirm to RFC3739, then
>>     RFC 3739 must be updated.
>>         In France, we have defined a French standard (RGS 1.0). I
>>         will provide an approximate translation of it:
>>
>>         the SIREN (9 characters) or SIRET number (14 characters) as
>>         given by the french INSEE organisation.
>>
>>         If we follow this direction, then already issued certificates
>>         for french organisation would
>>         Organisations currently delivering certificates to human
>>         beings would be able to continue to refer to RFC 3739
>>         and would not need to change their documentation in order to
>>         refer to the latest document
>>         Organisations that will deliver QCs to organisation units
>>         would be able to refer to a new RFC or a new ETSI TS.
>>
>>         Denis
>>
>>>         Denis,
>>>

---

From: Stefan Santesson <[email-masked]>
Date: Mon, 10 Jun 2013 12:25:15 +0200

Hi Denis,

The new profiles decided for Qualified Certificates decided in the ETSI ESI
work group does not fit within the current set of attributes listed in RFC
3739.

The legal person profile does not fit as it uses the organisationIdentifier
attribute instead of serialNumber.
The web server certificate profile does not fit either as it aligns with the
CAB forum certificate profile which relies on the SubjectAltName extension
for uniqueness.

The serialNumber is not desirable for organisation unique identifiers as
this attribute is used for natural person unique identifiers in certificates
issued to a natural person that is associated with an organisation.
So in certificates issued to a natural person that is associated with an
organisation and where you need a unique identifier both for the person and
the organisation, then you need different attributes for these unique
identifiers.
This is why the organizationIdentifier was added to X.520.

Thus using serial number for organisation unique identifiers in certificate
issued to legal persons will be very confusing.

I'v checked through RFC 3739 and find nothing that prevents this RFC from
being used for a legal person.
Yes, there are some text in the scoping of the standard that declares the
intent of the standard to support natural persons, but there are no
technical definitions that would prevent the document from being used for
legal person certificate, except the attribute list.

This is why I propose to do an update that;
1. opens up the current attribute requirements
2. Clarifies the scope to include certificates issued to legal persons.

/Stefan

From:  Denis <[email-masked]>
Date:  Tuesday, June 4, 2013 7:18 PM
To:  Stefan Santesson <[email-masked]>
Cc:  <[email-masked]>
Subject:  Re: [pkix] Update need to RFC 3739