Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 13:39:14 -0700

Nicolas Williams wrote:

> I thought you wanted to avoid duplication of Names in the
> AD-VERIFIED-CAs case,

Only for root CA we have this duplicated information issue, but I think
that issue is minor.

>           IssuerAndSerialNumber   [1] OCTET STRING OPTIONAL,
            ^^^^^^^^^^^^^^^^^^^^^
Right, should be:

            issuerAndSerialNumber   [1] OCTET STRING OPTIONAL,
            ^^^^^^^^^^^^^^^^^^^^^

Thanks.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 1:30 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]; [email-masked]
Subject: Re: What's in a Name?

On Thu, Jul 14, 2005 at 01:25:41PM -0700, Liqiang(Larry) Zhu wrote:
> > TD-INVALID-CERTIFICATES  REQUIRED*  REQUIRED         OPTIONAL
> 
> Why the DN is required for TD-INVALID-CERTIFICATES? The client has the
> whole certificate, and can find out the name byitself.

Agreed.  A CHOICE of SubjectKeyIdentifier or IssuerAndSerial should do
for TD-INVALID-CERTIFICATES.

...
> REPLACE with:
> 
> 
>        TrustedCA ::= SEQUENCE {
>           caName                  [0] IMPLICIT OCTET STRING,
>                    -- Contains a PKIX type Name encoded according to
>                    -- [RFC3280].
> 
>                    -- Identifies a CA by the CA's distinguished
subject
>                    -- name.
>           IssuerAndSerialNumber   [1] OCTET STRING OPTIONAL,
            ^^^^^^^^^^^^^^^^^^^^^

I thought you wanted to avoid duplication of Names in the
AD-VERIFIED-CAs case, so this should just be a serial number.  Also,
nit: the first letter there must not be uppercase.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 14 Jul 2005 15:48:42 -0500

> Only for root CA we have this duplicated information issue, but I think

Er, no, we have it throughout:

Example cert chain: Joe (EE cert) <- FOO Inc. <- BAR Inc <- ROOT Inc.

If Trusted-CA includes the Name of each cert in the chain plus the Name
of the issuer then all non-anchor CA names but the last one appear twice
and if the anchor CA is self-signed then its Name appears thrice as well:

{ { FOO Inc,  issued by BAR Inc.,  serial 12345},
  { BAR Inc,  issued by ROOT Inc., serial 12345},
  { ROOT Inc, issued by ROOT Inc., serial 12345} }

BAR appears twice and ROOT appears thrice.

I thought this was your concern.

Nico
--