Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 13 Jul 2005 10:42:21 -0700

It would to be fine to include the serial # in order to support the
deployed non-IEF-conforming implementations.

-- Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Chaskiel M
Grundman
Sent: Wednesday, July 13, 2005 10:26 AM
To: [email-masked]
Subject: RE: What's in a Name?

--On Wednesday, July 13, 2005 09:34:16 AM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> The SubjectKeyIdentifier extension is actually REQUIRED for CA
> certificates. Here is the text in RFC3280. (Martin, RFC3280 is the
IETF
> version of X.509).

Standards say lots of things. That doesn't mean the deployed 
implementations we have to work with actually follow them. None of the
CA 
root certificates from verisign/thawte that are shipped with recent
mozilla 
(at least, as extracted by debian into the 'ca-certificates' package. I 
didn't check the actual mozilla sources) include SubjectKeyIdentifier 
extensions.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 13 Jul 2005 13:49:19 -0400

> deployed non-IEF-conforming implementations.

It is worth noting again that a serial number alone is meaningless.
Given current practice, is is reasonable to say "MUST include at least one 
of IssuerAndSerialNumber or SubjectKeyIdentifier; SHOULD include 
SubjectKeyIdentifier if the cert has one" ?

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 13 Jul 2005 12:51:39 -0500

> SubjectKeyIdentifier if the cert has one" ?

To me it seems reasonable.  A CHOICE perhaps?  Anyways, we may want
advice on this from Russ.

---

From: Brian Tung <[email-masked]>
Date: Wed, 13 Jul 2005 11:05:36 -0700

> advice on this from Russ.

I thought about CHOICE, but didn't want to preclude giving both, should
that be desirable.  (Should it be?)

-- 
Brian Tung <[email-masked]>
USC Information Sciences Institute