Subject: RE: What's in a Name - nearing the end?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 23:09:01 -0700

Updated proposal, please review:

OLD:

       TrustedCA ::= SEQUENCE {
          caName                  [0] IMPLICIT OCTET STRING,
                   -- Contains a PKIX type Name encoded according to
                   -- [RFC3280].
                   -- Identifies a CA by the CA's distinguished subject
                   -- name.
          certificateSerialNumber [1] INTEGER OPTIONAL,
                   -- Specifies the CA certificate's serial number.
                   -- The definition of the certificate serial number
                   -- is taken from X.509 [X.509-97].
          subjectKeyIdentifier    [2] OCTET STRING OPTIONAL,
                   -- Identifies the CA's public key by a key
                   -- identifier.  When an X.509 certificate is
                   -- referenced, this key identifier matches the X.509
                   -- subjectKeyIdentifier extension value.  When other
                   -- certificate formats are referenced, the documents
                   -- that specify the certificate format and their use
                   -- with the CMS must include details on matching the
                   -- key identifier to the appropriate certificate
                   -- field.
          ...
       }

REPLACE with:

       TrustedCA ::= SEQUENCE {
          caName                  [0] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a PKIX type Name encoded according to
                   -- [RFC3280].
                   -- Identifies a CA by the CA's distinguished subject
                   -- name.
          issuerAndSerialNumber   [1] OCTET STRING OPTIONAL,
                   -- Contains a CMS type IssuerAndSerialNumber encoded 
                   -- according to [RFC3852].
                   -- Identifies a CA's certificate.  
                   -- This field is REQUIRED for 
                   -- TD-TRUSTED-CERTIFIERS but can be omitted
                   -- if the subjectKeyIdentifier field below is present.
                   -- MUST be present if subjectKeyIdentifier is absent.
          subjectKeyIdentifier    [2] OCTET STRING OPTIONAL,
                   -- Identifies the CA's public key by a key
                   -- identifier.  When an X.509 certificate is
                   -- referenced, this key identifier matches the X.509
                   -- subjectKeyIdentifier extension value.  When other
                   -- certificate formats are referenced, the documents
                   -- that specify the certificate format and their use
                   -- with the CMS must include details on matching the
                   -- key identifier to the appropriate certificate
                   -- field.
                   -- This field is RECOMMENDED for 
                   -- TD-TRUSTED-CERTIFIERS.
          ...
       }

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Love Hörnquist Åstrand
Sent: Thursday, July 14, 2005 10:52 PM
To: Jeffrey Hutzelman
Cc: [email-masked]
Subject: Re: What's in a Name - nearing the end?

Jeffrey Hutzelman <[email-masked]> writes:

> So, here is strawman 3:
> Field                    Name       IssuerAndSerial
> SubjectKeyIdentifier For
> TD-TRUSTED-CERTIFIERS    REQUIRED   REQUIRED         RECOMMENDED*
> TD-INVALID-CERTIFICATES  REQUIRED*  REQUIRED         OPTIONAL
> AD-INITIAL-VERIFIED-CAS  REQUIRED   OPTIONAL         OPTIONAL
> (*) If present in certificate
>
>
> Emprical evidence suggests to me that we are converging, with the only
> significant open issue being the one of whether to require a subject DN
> in TD-INVALID-CERTIFICATES (assuming one is present in the cert).  Some
> compromise would be nice...

I would like to see Name changed to RECOMMENDED or OPTIONAL, if the
software wants to be unfriendly, let it. I don't care too strongly about it
though.

Love

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 15 Jul 2005 02:19:52 -0400

>                    -- TD-TRUSTED-CERTIFIERS.

That doesn't say the same thing as strawman 3:

- It does not indicate that caName is REQUIRED when there is a subject DN
  present in the certificate

- It does not indicate that issuerAndSerialNumber is REQUIRED for
  TD-INVALID-CERTIFICATES

- For TD-TRUSTED-CERTIFIERS, it permits issuerAndSerialNumber to be
  omitted if subjectKeyIdentifier is given.  I don't object to that
  approach, but it is not what strawman 3 says.

Also, a couple of other comments...
I think all three fields should be IMPLICIT; that saves us at least two 
octets of encoding per field per TrustedCA.  And, I think the "caName" 
field is poorly named, and likely to confuse someone into thinking they 
should put the issuer DN there, even though the spec does not say that.

-- Jeff