Subject: What's in a Name?

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 14 Mar 2005 19:53:26 -0500

As some of you may have noticed, I have been looking back over mailing list 
traffic in an effort to identify all of the issues on PKINIT and determine 
which have been resolved and which are still open.

In the process I found a number of threads of discussion on what 
identifiers to use in InitialVerifiedCAs, TD-TRUSTED-CERTIFIERS, and 
TD-INVALID-CERTIFICATES (formerly TD-CERTIFICATE-INDEX).  The threads 
surrounding these were quite intertwined, making the discussion difficult 
to follow.  However, I think I have come to some conclusions.

All three of these types are a list of _something_.  The main issue seems 
to be what exactly that something should be.  It strikes me that this is 
actually _three_ issues which are similar, but distinct.

(a) What should InitialVerifiedCAs be?
    In pkinit-22, it was a SEQUENCE OF SEQUENCE {}, with the
    inner sequence containing a Name and a BOOLEAN.  After discussion,
    the BOOLEAN was dropped, leaving a SEQUENCE OF Name.
    Larry proposed replacing the Name with an IssuerAndSerialNumber.
    Martin commented that he thought that was a bad idea.
    In pkinit-25 it is a SEQUENCE OF TrustedCA.

(b) What should TD-INVALID-CERTIFICATES be?
    In pkinit-22, TD-CERTIFICATE-INDEX was an IssuerAndSerialNumber
    In pkinit-24, TD-INVALID-CERTIFICATES was a SEQUENCE OF OCTET STRING
    wrapping IssuerAndSerialNumber
    Martin commented that he thought that was a bad idea.
    In pkinit-25 it is a SEQUENCE of TrustedCA.

(c) What should TD-TRUSTED-CERTIFIERS be a SEQUENCE of?
    In pkinit-22, it was a SEQUENCE OF OCTED STRING wrapping Name.
    In pkinit-25, it is a SEQUENCE OF TrustedCA

Note that I'm glossing over some things here; there was a fair bit of 
discussion involved before we reached the current state of having 
everything be a SEQUENCE OF TrustedCA.  In addition to those changes, the 
definition of TrustedCA itself has changed somewhat:

pkinit-22:
       TrustedCA ::= CHOICE {
          caName                  [1] Name,
                                      -- Fully qualified X.500 name
                                      -- as defined in [RFC3280].
          issuerAndSerial         [2] IMPLICIT WrapIssuerAndSerial,
                                      -- Identifies a specific CA
                                      -- certificate.
          ...
       }

pkinit-25:
       TrustedCA ::= SEQUENCE {
          caName                  [0] IMPLICIT OCTET STRING,
                   -- Contains a PKIX type Name encoded according to
                   -- [RFC3280].
                   -- Identifies a CA by the CA's distinguished subject
                   -- name.
          certificateSerialNumber [1] INTEGER OPTIONAL,
                   -- Specifies the CA certificate's serial number.
                   -- The defintion of the certificate serial number
                   -- is taken from X.509 [X.509-97].
          subjectKeyIdentifier    [2] OCTET STRING OPTIONAL,
                   -- Identifies the CA's public key by a key
                   -- identifier.  When an X.509 certificate is
                   -- referenced, this key identifier matches the X.509
                   -- subjectKeyIdentifier extension value.  When other
                   -- certificate formats are referenced, the documents
                   -- that specify the certificate format and their use
                   -- with the CMS must include details on matching the
                   -- key identifier to the appropriate certificate
                   -- field.
          ...
       }

My main concern is that it is hard for me to tell who was arguing for or 
against what changes, which makes it nigh impossible to figure out whether 
we have consensus for any of these changes, let alone all of them.  To that 
end, I'd like to get comments from members of the working group on several 
questions:

(a) What should InitialVerifiedCAs be?
    SEQUENCE OF OCTET STRING wrapping Name?
    SEQUENCE OF TrustedCA?
    Something else?
    This is ticket #836

(b) What should TD-INVALID-CERTIFICATES be?
    SEQUENCE OF OCTET STRING wrapping IssuerAndSerialNumber?
    SEQUENCE OF TrustedCA?
    Something else?
    This is ticket #864

(c) What should TD-TRUSTED-CERTIFIERS be a SEQUENCE of?
    SEQUENCE OF OCTET STRING wrapping Name?
    SEQUENCE OF TrustedCA?
    Something else?
    This is ticket #865

I'd also like to ask one additional question:

(d) Is the definition of TrustedCA in pkinit-25 acceptable?
    This is ticket #866

Some comments on these questions would be nice, so we can close out this 
fairly messy issue.

-- Jeff