Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 13 Jul 2005 10:56:48 -0700

agree,

< clarification > in -26 the issuer DN is required, my assertion earlier
is based on -26, and you can optionally include the serial # (assuming
the issuer is always present).</clarifications>

Here is what I think,

To identify a CA, the issuer DN is required, one of the two (serial # or
SubjectKeyIdentifier) is recommended to be present, but not required.

-- Larry

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Wednesday, July 13, 2005 10:49 AM
To: Liqiang(Larry) Zhu; Chaskiel M Grundman; [email-masked]
Subject: RE: What's in a Name?

On Wednesday, July 13, 2005 10:42:21 AM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> It would to be fine to include the serial # in order to support the
> deployed non-IEF-conforming implementations.

It is worth noting again that a serial number alone is meaningless.
Given current practice, is is reasonable to say "MUST include at least
one 
of IssuerAndSerialNumber or SubjectKeyIdentifier; SHOULD include 
SubjectKeyIdentifier if the cert has one" ?

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 13 Jul 2005 11:32:25 -0700

Agree.

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Wednesday, July 13, 2005 11:29 AM
To: Liqiang(Larry) Zhu; Nicolas Williams
Cc: Chaskiel M Grundman; [email-masked]
Subject: RE: What's in a Name?

On Wednesday, July 13, 2005 11:25:10 AM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Also, we need to avoid including the issuer DN twice, for one reason,
it
> is fairly big; another reason is if you include two copies of the same
> value, what if they do not match and how to match them?
>
> <disclaimer>this seems to be handled in -26, hats-off</disclaimer>

No one suggested including the issuer DN twice.
The DN in IssuerAndSerialNumber is the issuer DN.
The only other Name we've been talking about would always be a subject
DN

---

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 13 Jul 2005 21:49:02 +0100

Yes, SKI MUST be included in all CA certificates.

AKI MUST be present in all certificates (EE and CA), excluding root certificates where it my be omitted

The purpose of SKI and AKI is only to support more effective path construction. They are not enforced in path validation. That is, the path is still valid even if SKI/AKI does not match in a path.

I can't see any problem with including AKI an SKI in certificates.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> From: Liqiang(Larry) Zhu
> Sent: den 13 juli 2005 18:34
> To: Love Hörnquist Åstrand; Jeffrey Hutzelman; Stefan Santesson
> Cc: [email-masked]; [email-masked]
> The SubjectKeyIdentifier extension is actually REQUIRED for CA
> certificates. Here is the text in RFC3280. (Martin, RFC3280 is the IETF
> version of X.509).
> 
>    <<cut>> "this extension MUST
>    appear in all conforming CA certificates" <<cut>>
> 
> I also looped in Stefan to help us interpret the text in RFC3280.
> 
> -- Larry
> 
> From: Love Hörnquist Åstrand [mailto:[email-masked]]
> Sent: Wednesday, July 13, 2005 12:32 AM
> To: Jeffrey Hutzelman
> Cc: Liqiang(Larry) Zhu; [email-masked]; [email-masked]
> Subject: Re: What's in a Name?
> 
> 
> Jeffrey Hutzelman <[email-masked]> writes:
> 
> > So, let's go back a step...
> > I'm going to try to ask questions in more detail.  Answers from all
> > parties are encouraged...
> 
> REQUIRE SubjectKeyIdentifier would be unwise given the use of today CA's.
> 
> IssuerAndSerialNumber or SubjectKeyIdentifier should be the items that is
> used, any of those two uniquely indentifies the certificate. Name might be
> used to be friendly to the user/sysadmin, but have not real use for the
> protocol/implementations given its non-uniqueness.
> 
> Love

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 17:25:29 -0700

AD-INITIAL-VERIFIED-CA is not for leaf certs, Nico?

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 5:23 PM
To: Liqiang(Larry) Zhu; [email-masked]
Cc: [email-masked]; Stefan Santesson; [email-masked]
Subject: RE: What's in a Name?

On Thursday, July 14, 2005 05:15:50 PM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Jeffrey Hutzelman wrote:
>> We run into those issues anyway for TD-TRUSTED-CERTIFIERS and
> AD-INITIAL->
>> VERIFIED-CAS.
>
> No, my assumption is the subject DN is always present for the CA
> certificate.

OK, so we don't run into the "Name not present" for
TD-TRUSTED-CERTIFIERS.
What about AD-INITIAL-VERIFIED-CA's?  I don't remember; does that
include 
the leaf cert or only the CA's?

---

From: "Stefan Santesson" <[email-masked]>
Date: Fri, 22 Jul 2005 15:29:16 +0100

Excuse the delayed response.

I'm not sure that the following is of any use in your discussion but, as
Larry points out, CA certificates compliant with RFC 3280 MUST contain a
non empty DN.

The reason is not just to provide a meaningful name of CA's but rather
that implementations may fail building the certificate path unless CA
certificates contains a DN.

Subject certificates may omit a subject DN but MUST then contain a
non-empty subjectAltName extension marked as critical.

Stefan Santesson

> Sent: den 14 juli 2005 17:23
TD-TRUSTED-CERTIFIERS.
include