Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 14:54:13 -0700

Nico, there is only one TD-xxx to consider, I am ok either way but does
anybody care enough to make such a change?

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 2:19 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]; [email-masked]
Subject: Re: What's in a Name?

On Thu, Jul 14, 2005 at 02:16:09PM -0700, Liqiang(Larry) Zhu wrote:
> 
> if you have the duplicated CA name in separate TrustedCA structure, it
> helps to construct a chain alike structure, I think this is better if
a
> trustedCa structure is self-contained. 

If you use Trust-CA only for AD-VERIFIED-CAs then you can avoid all that
duplication.  It does mean using a different type for the TD-* cases.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 14 Jul 2005 16:57:42 -0500

> anybody care enough to make such a change?

I count two: TD-TRUSTED-CERTIFIERS and TD-INVALID-CERTIFICATES.

I think it should perfectly alright to use a CHOICE (in the ASN.1 sense
or otherwise) of IssuerAndSerial and SubjectKeyIdentifier for
TD-INVALID-CERTIFICATES as we just agreed.

For TD-TRUSTED-CERTIFIERS we need CA Names that the client can show to
users and we need IssuerAndSerial/SubjectKeyIdentifier to help find the
actual anchors.

For AD-VERIFIED-CAs we need CA Names and would be happy to also have
IssuerAndSerial/SubjectKeyIdentifier