Subject: RE: What's in a Name - nearing the end?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 23:32:42 -0700

Good points:

Adjusted:

       TrustedCA ::= SEQUENCE {
          subject                 [0] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a PKIX type Name encoded according to
                   -- [RFC3280].
                   -- Identifies a CA by the CA's distinguished subject
                   -- name.
                   -- REQUIRED when there is a subject DN present in the 
                   -- CA's certificate.
          issuerAndSerialNumber   [1] IMPLICIT OCTET STRING OPTIONAL,
                   -- Contains a CMS type IssuerAndSerialNumber encoded 
                   -- according to [RFC3852].
                   -- Identifies a CA's certificate.  
                   -- For TD-TRUSTED-CERTIFIERS, this is REQUIRED but can be 
                   -- omitted if the subjectKeyIdentifier field below is 
                   -- present. 
          subjectKeyIdentifier    [2] IMPLICIT OCTET STRING OPTIONAL,
                   -- Identifies the CA's public key by a key
                   -- identifier.  When an X.509 certificate is
                   -- referenced, this key identifier matches the X.509
                   -- subjectKeyIdentifier extension value.  When other
                   -- certificate formats are referenced, the documents
                   -- that specify the certificate format and their use
                   -- with the CMS must include details on matching the
                   -- key identifier to the appropriate certificate
                   -- field.
                   -- This field is RECOMMENDED for 
                   -- TD-TRUSTED-CERTIFIERS.
          ...
       }

> - It does not indicate that issuerAndSerialNumber is REQUIRED for
>  TD-INVALID-CERTIFICATES

TD-INVALID-CERTIFICATES can contain leaf certificates, therefore would it be awkward to call it TrustedCA?

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 11:20 PM
To: Liqiang(Larry) Zhu; Love Hörnquist Åstrand
Cc: [email-masked]
Subject: RE: What's in a Name - nearing the end?

On Thursday, July 14, 2005 11:09:01 PM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Updated proposal, please review:
> REPLACE with:
>
>
>        TrustedCA ::= SEQUENCE {
>           caName                  [0] IMPLICIT OCTET STRING OPTIONAL,
>                    -- Contains a PKIX type Name encoded according to
>                    -- [RFC3280].
>                    -- Identifies a CA by the CA's distinguished subject
>                    -- name.
         
>           issuerAndSerialNumber   [1] OCTET STRING OPTIONAL,
>                    -- Contains a CMS type IssuerAndSerialNumber encoded
>                    -- according to [RFC3852].
>                    -- Identifies a CA's certificate.
>                    -- This field is REQUIRED for
>                    -- TD-TRUSTED-CERTIFIERS but can be omitted
>                    -- if the subjectKeyIdentifier field below is present.
>                    -- MUST be present if subjectKeyIdentifier is absent.
>           subjectKeyIdentifier    [2] OCTET STRING OPTIONAL,
>                    -- Identifies the CA's public key by a key
>                    -- identifier.  When an X.509 certificate is
>                    -- referenced, this key identifier matches the X.509
>                    -- subjectKeyIdentifier extension value.  When other
>                    -- certificate formats are referenced, the documents
>                    -- that specify the certificate format and their use
>                    -- with the CMS must include details on matching the
>                    -- key identifier to the appropriate certificate
>                    -- field.
>                    -- This field is RECOMMENDED for
>                    -- TD-TRUSTED-CERTIFIERS.
>           ...
>        }

That doesn't say the same thing as strawman 3:

- It does not indicate that caName is REQUIRED when there is a subject DN
  present in the certificate

- It does not indicate that issuerAndSerialNumber is REQUIRED for
  TD-INVALID-CERTIFICATES

- For TD-TRUSTED-CERTIFIERS, it permits issuerAndSerialNumber to be
  omitted if subjectKeyIdentifier is given.  I don't object to that
  approach, but it is not what strawman 3 says.

Also, a couple of other comments...
I think all three fields should be IMPLICIT; that saves us at least two 
octets of encoding per field per TrustedCA.  And, I think the "caName" 
field is poorly named, and likely to confuse someone into thinking they 
should put the issuer DN there, even though the spec does not say that.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 15 Jul 2005 02:45:57 -0400

> be awkward to call it TrustedCA?

Well, yes, it is awkward to call the structure TrustedCA when it is used
for other than trusted certifiers.  That's true even if we don't use this
type for TD-INVALID-CERTIFICATES, since AD-INITIAL-VERIFIED-CAS are not
"trusted" CA's; they're just CA's.

My answer would be to rename the structure, rather than making up a
completely separate but substantially similar type for TD-INVALID-CERTS.
But it doesn't really bother me to do it that way, if you prefer.