Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 13:55:33 -0700

My concern was to avoid duplication information in the same TrustCA
structure.

I am fine with the duplicated information in separate TrustedCA in your
example.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 1:49 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]; [email-masked]
Subject: Re: What's in a Name?

On Thu, Jul 14, 2005 at 01:39:14PM -0700, Liqiang(Larry) Zhu wrote:
> Nicolas Williams wrote:
> 
> > I thought you wanted to avoid duplication of Names in the
> > AD-VERIFIED-CAs case,
> 
> Only for root CA we have this duplicated information issue, but I
think
> that issue is minor.

Er, no, we have it throughout:

Example cert chain: Joe (EE cert) <- FOO Inc. <- BAR Inc <- ROOT Inc.

If Trusted-CA includes the Name of each cert in the chain plus the Name
of the issuer then all non-anchor CA names but the last one appear twice
and if the anchor CA is self-signed then its Name appears thrice as
well:

{ { FOO Inc,  issued by BAR Inc.,  serial 12345},
  { BAR Inc,  issued by ROOT Inc., serial 12345},
  { ROOT Inc, issued by ROOT Inc., serial 12345} }

BAR appears twice and ROOT appears thrice.

I thought this was your concern.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 14 Jul 2005 16:11:56 -0500

> I am fine with the duplicated information in separate TrustedCA in your

Really?  Why the difference?