Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 12 Jul 2005 12:20:18 -0700

Jeffrey Hutzelman wrote:
> However, both TD-TRUSTED-CERTIFIERS and TD-INVALID-CERTIFICATES need
the 
> ability to uniquely identify a particular certificate, so for these
cases > the IssuerAndSerialNumber needs to be REQUIRED.

subjectKeyIdentifier is sufficient to identify the cert for all
practical purposes.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey
Hutzelman
Sent: Tuesday, July 12, 2005 12:11 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: What's in a Name?

On Tuesday, July 12, 2005 07:09:35 PM +0200 Martin Rex
<[email-masked]> 
wrote:

> And when I consider what efforts Microsoft seems to be undertaking in
> preventing user enumeration of Windows Domains, then I don't see how
> a client which is faced with a PKINIT authentication failure could
> make sense from issuer&serial (with the exception that it already
> has this particular certificate -- but in that case the subject
> DName should be equally sufficient!).

Except I've already told you why the DN is not sufficient -- in a
rollover 
situation, the same chain may contain multiple certificates with the
same 
Name.  In this case it may be important to tell which one failed
validation.

Earlier you wrote:
> When identifying trust anchors by name rather than by issuer&serial
then
> certificate rollover is transparent.

Not entirely true.  Trust anchors are specific keys, not names.  We're
not 
talking about configuration here; we're talking about the KDC telling
the 
client which CA's are trusted, so the client can build a proper chain.
In 
a rollover situation, the correct certificate chain depends on whether
the 
KDC's trust anchor is the new key or the old one.  If the trust anchor
is 
the old key, the the client needs to include a rollover cert.

Speaking as an individual, I think Martin makes a strong case for
including 
distinguished names in all three contexts.  This is why I proposed
making 
the Name field be REQUIRED in InitialVerifiedCAs and at least
RECOMMENDED 
in the other cases.  I'm fine with making it REQUIRED in all three
cases, 
if that's what the WG prefers.  However, both TD-TRUSTED-CERTIFIERS and 
TD-INVALID-CERTIFICATES need the ability to uniquely identify a
particular 
certificate, so for these cases the IssuerAndSerialNumber needs to be 
REQUIRED.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 12 Jul 2005 15:53:24 -0400

> subjectKeyIdentifier is sufficient to identify the cert for all

Are you suggesting adding a subjectKeyIdentifier to the SEQUENCE?
Should this be REQUIRED instead of IssuerAndSerialNumber?
Or should both be REQUIRED?
Or should the requirement be "MUST have at least one"?

Or are you suggesting that IssuerAndSerialNumber be removed entirely?

-- Jeff