Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 15:00:17 -0700

Nicolas Williams wrote:
> I think it should perfectly alright to use a CHOICE (in the ASN.1
sense or > otherwise) of IssuerAndSerial and SubjectKeyIdentifier for
TD-INVALID-> 
> CERTIFICATES as we just agreed.

IssuerAndSerial should be sufficient for TD-INVALID-CERTIFICATES, do you

have a scenario where you need the SubjectKeyIdentifier for
TD-INVALID-CERTIFICATES?

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 2:58 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]; [email-masked]
Subject: Re: What's in a Name?

On Thu, Jul 14, 2005 at 02:54:13PM -0700, Liqiang(Larry) Zhu wrote:
> Nico, there is only one TD-xxx to consider, I am ok either way but
does
> anybody care enough to make such a change?

I count two: TD-TRUSTED-CERTIFIERS and TD-INVALID-CERTIFICATES.

I think it should perfectly alright to use a CHOICE (in the ASN.1 sense
or otherwise) of IssuerAndSerial and SubjectKeyIdentifier for
TD-INVALID-CERTIFICATES as we just agreed.

For TD-TRUSTED-CERTIFIERS we need CA Names that the client can show to
users and we need IssuerAndSerial/SubjectKeyIdentifier to help find the
actual anchors.

For AD-VERIFIED-CAs we need CA Names and would be happy to also have
IssuerAndSerial/SubjectKeyIdentifier

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 14 Jul 2005 17:02:03 -0500

> have a scenario where you need the SubjectKeyIdentifier for

No, I don't.