Subject: RE: What's in a Name - nearing the end?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 15 Jul 2005 00:28:48 -0700

Added that too:

       ExternalPrincipalIdentifier ::= SEQUENCE {
          subjectName            [0] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a PKIX type Name encoded according to
                   -- [RFC3280].
                   -- Identifies the certificate subject by the 
                   -- distinguished subject name.
                   -- REQUIRED when there is a distinguished subject name 
                   -- present in the certificate.
          issuerAndSerialNumber   [1] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a CMS type IssuerAndSerialNumber encoded 
                   -- according to [RFC3852].
                   -- Identifies a certificate of the subject. 
                   -- REQUIRED for TD-INVALID-CERTIFICATES. 
                   -- For TD-TRUSTED-CERTIFIERS, this field is REQUIRED 
                   -- but can be omitted if the subjectKeyIdentifier field 
                   -- below is present. 
          subjectKeyIdentifier    [2] IMPLICIT OCTET STRING OPTIONAL,
                   -- Identifies the subject's public key by a key
                   -- identifier.  When an X.509 certificate is
                   -- referenced, this key identifier matches the X.509
                   -- subjectKeyIdentifier extension value.  When other
                   -- certificate formats are referenced, the documents
                   -- that specify the certificate format and their use
                   -- with the CMS must include details on matching the
                   -- key identifier to the appropriate certificate
                   -- field.
                   -- RECOMMENDED for TD-TRUSTED-CERTIFIERS.
          ...
       }

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Friday, July 15, 2005 12:25 AM
To: Liqiang(Larry) Zhu; Love Hörnquist Åstrand
Cc: [email-masked]
Subject: RE: What's in a Name - nearing the end?

On Friday, July 15, 2005 12:06:56 AM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Taking the least resistance path, TD-INVALID-CERTIFICATES,
> TD-TRUSTED-CERTIFIERS and AD-INITIAL-VERIFIED-CA shall all use
> ExternalPrincipalIdentifier.
>
>
>
>        ExternalPrincipalIdentifier ::= SEQUENCE {
>           subjectName            [0] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Contains a PKIX type Name encoded according to
>                    -- [RFC3280].
>                    -- Identifies the certificate subject by the
>                    -- distinguished subject name.
>                    -- REQUIRED when there is a distinguished subject name
>                    -- present in the certificate.
>           issuerAndSerialNumber   [1] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Contains a CMS type IssuerAndSerialNumber encoded
>                    -- according to [RFC3852].
>                    -- Identifies a certificate of the subject.
>                    -- For TD-TRUSTED-CERTIFIERS, this is REQUIRED but can 
be
>                    -- omitted if the subjectKeyIdentifier field below is
>                    -- present.
>           subjectKeyIdentifier    [2] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Identifies the subject's public key by a key
>                    -- identifier.  When an X.509 certificate is
>                    -- referenced, this key identifier matches the X.509
>                    -- subjectKeyIdentifier extension value.  When other
>                    -- certificate formats are referenced, the documents
>                    -- that specify the certificate format and their use
>                    -- with the CMS must include details on matching the
>                    -- key identifier to the appropriate certificate
>                    -- field.
>                    -- This field is RECOMMENDED for
>                    -- TD-TRUSTED-CERTIFIERS.
>           ...
>        }
>
> ExternalPrincipalIdentifier means it is not Kerberos principal.

This is still missing the bit about issuerAndSerialNumber being
REQUIRED for TD-INVALID-CERTIFICATES.  Otherwise, I believe this
matches my "strawman 3".  So hopefully if people are happy with one,
they'll be happy with the other.

-- Jeff