Subject: RE: What's in a Name - nearing the end?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 15 Jul 2005 00:06:56 -0700

Taking the least resistance path, TD-INVALID-CERTIFICATES, TD-TRUSTED-CERTIFIERS and AD-INITIAL-VERIFIED-CA shall all use ExternalPrincipalIdentifier.

       ExternalPrincipalIdentifier ::= SEQUENCE {
          subjectName            [0] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a PKIX type Name encoded according to
                   -- [RFC3280].
                   -- Identifies the certificate subject by the 
                   -- distinguished subject name.
                   -- REQUIRED when there is a distinguished subject name 
                   -- present in the certificate.
          issuerAndSerialNumber   [1] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a CMS type IssuerAndSerialNumber encoded 
                   -- according to [RFC3852].
                   -- Identifies a certificate of the subject.  
                   -- For TD-TRUSTED-CERTIFIERS, this is REQUIRED but can be 
                   -- omitted if the subjectKeyIdentifier field below is 
                   -- present. 
          subjectKeyIdentifier    [2] IMPLICIT OCTET STRING OPTIONAL,
                   -- Identifies the subject's public key by a key
                   -- identifier.  When an X.509 certificate is
                   -- referenced, this key identifier matches the X.509
                   -- subjectKeyIdentifier extension value.  When other
                   -- certificate formats are referenced, the documents
                   -- that specify the certificate format and their use
                   -- with the CMS must include details on matching the
                   -- key identifier to the appropriate certificate
                   -- field.
                   -- This field is RECOMMENDED for 
                   -- TD-TRUSTED-CERTIFIERS.
          ...
       }

ExternalPrincipalIdentifier means it is not Kerberos principal.

Comments?

-- Larry

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 11:46 PM
To: Liqiang(Larry) Zhu; Love Hörnquist Åstrand
Cc: [email-masked]
Subject: RE: What's in a Name - nearing the end?

On Thursday, July 14, 2005 11:32:42 PM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

>
> Good points:
>
> Adjusted:
>
>        TrustedCA ::= SEQUENCE {
>           subject                 [0] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Contains a PKIX type Name encoded according to
>                    -- [RFC3280].
>                    -- Identifies a CA by the CA's distinguished subject
>                    -- name.
>                    -- REQUIRED when there is a subject DN present in the
>                    -- CA's certificate.
>           issuerAndSerialNumber   [1] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Contains a CMS type IssuerAndSerialNumber encoded
>                    -- according to [RFC3852].
>                    -- Identifies a CA's certificate.
>                    -- For TD-TRUSTED-CERTIFIERS, this is REQUIRED but can 
be
>                    -- omitted if the subjectKeyIdentifier field below is
>                    -- present.
>           subjectKeyIdentifier    [2] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Identifies the CA's public key by a key
>                    -- identifier.  When an X.509 certificate is
>                    -- referenced, this key identifier matches the X.509
>                    -- subjectKeyIdentifier extension value.  When other
>                    -- certificate formats are referenced, the documents
>                    -- that specify the certificate format and their use
>                    -- with the CMS must include details on matching the
>                    -- key identifier to the appropriate certificate
>                    -- field.
>                    -- This field is RECOMMENDED for
>                    -- TD-TRUSTED-CERTIFIERS.
>           ...
>        }
>
>> - It does not indicate that issuerAndSerialNumber is REQUIRED for
>>  TD-INVALID-CERTIFICATES
>
> TD-INVALID-CERTIFICATES can contain leaf certificates, therefore would it
> be awkward to call it TrustedCA?

Well, yes, it is awkward to call the structure TrustedCA when it is used
for other than trusted certifiers.  That's true even if we don't use this
type for TD-INVALID-CERTIFICATES, since AD-INITIAL-VERIFIED-CAS are not
"trusted" CA's; they're just CA's.

My answer would be to rename the structure, rather than making up a
completely separate but substantially similar type for TD-INVALID-CERTS.
But it doesn't really bother me to do it that way, if you prefer.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 15 Jul 2005 03:25:28 -0400

On Friday, July 15, 2005 12:06:56 AM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Taking the least resistance path, TD-INVALID-CERTIFICATES,
> TD-TRUSTED-CERTIFIERS and AD-INITIAL-VERIFIED-CA shall all use
> ExternalPrincipalIdentifier.
>
>
>
be
> ExternalPrincipalIdentifier means it is not Kerberos principal.

This is still missing the bit about issuerAndSerialNumber being
REQUIRED for TD-INVALID-CERTIFICATES.  Otherwise, I believe this
matches my "strawman 3".  So hopefully if people are happy with one,
they'll be happy with the other.

-- Jeff