Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 13 Jul 2005 10:58:07 -0700

Nicolas Williams wrote:
> To me it seems reasonable.  A CHOICE perhaps?

Not a CHOICE. We should allow the sender to include both, in order to
maximize interoperability.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, July 13, 2005 10:52 AM
To: Jeffrey Hutzelman
Cc: Liqiang(Larry) Zhu; Chaskiel M Grundman; [email-masked]
Subject: Re: What's in a Name?

On Wed, Jul 13, 2005 at 01:49:19PM -0400, Jeffrey Hutzelman wrote:
> 
> 
> On Wednesday, July 13, 2005 10:42:21 AM -0700 "Liqiang(Larry) Zhu" 
> <[email-masked]> wrote:
> 
> >It would to be fine to include the serial # in order to support the
> >deployed non-IEF-conforming implementations.
> 
> It is worth noting again that a serial number alone is meaningless.
> Given current practice, is is reasonable to say "MUST include at least
one 
> of IssuerAndSerialNumber or SubjectKeyIdentifier; SHOULD include 
> SubjectKeyIdentifier if the cert has one" ?

To me it seems reasonable.  A CHOICE perhaps?  Anyways, we may want
advice on this from Russ.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 13 Jul 2005 13:02:40 -0500

> maximize interoperability.

If that's what you want then both IssuerAndSerial MUST be present and
SubjectKeyIdentifier MUST be present when the cert in question has that
extension.

I think that's overkill.

It's one thing to worry about interop with existing, deployed CAs and
another to worry that folks will not implement the PKINIT spec properly
(not that we shouldn't, but the two are very different issues).

Nico
--

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 13 Jul 2005 14:12:34 -0400

> SubjectKeyIdentifier MUST be present when the cert in question has that

I agree with Larry; this should not be a CHOICE; it should be two separate 
items in the SEQUENCE.  Both of these should be "OPTIONAL" in the ASN.1 
sense, but I think that we need to REQUIRED (in RFC2119 sense) that at 
least one of them be present, because a Name is not sufficient to select a 
correct certificate from among several which might belong to the same CA.

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 13 Jul 2005 13:21:58 -0500

> correct certificate from among several which might belong to the same CA.

But there's always an issuer and a serial number though (correct me if
I'm wrong), so IssuerAndSerial shouldn't be OPTIONAL then.