Subject: Re: unqualified topic - not solved yet.

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 1 Dec 1999 06:35:52 -0000

Charles,
Being the one who originally brought this pesty thing out of the dark
I will try to comment this

<snip>

> Indeed, I would like Charles to
>elaborate just a bit on how the "wrong semantics" would now conflict
>with the "right semantics" already in use.  Concrete examples if possible.
>
>cm> I issue a cert to a machine ( under deligation policy rules) I want the
>delegation to be controlled to a specific machine and make use of a machine
>serail number... I place the serial number into the attraibute... Alll works
>ok ( also belive that the semantics assocaited with "machine serial numebr
>are uniqueness)...  Now all of a sudden I get one of these PKIX things that
>has National ID  of a person in the same attribute... I apply my policy that
>says that any certifiacte for a device must have a serial number and .....

I don't see why this should be a probem.  Every certificate-class can (and usually have)
its own CPS and rules.   The serialNumber stuff is just an OPTION (but for certain
classes of certificates it will be mandatory) that an RP can use in such a way that
QCs indeed can be compared which was where all this started.

<snip>

>cm> Need to determine if serial number is the single attribute for
>uniqueness ?, this would be a problem from my perspective, or it is for
>determining uniquess when there are no other unique attribute....  The first
>is a problem for a global QC the latter should meet the requirements as I
>have seen them stated....

I hope that the semanics are such that if serialnumber is available the
rest of subject (or issuer) data (available or not) can be treated as "informative" only.

Exactly what naming domain serialNumber belongs to, I assume unfortunately
is still be a part of CPS.  I.e. it could be CA-unique or "externally defined"

Regarding global QCs: Assuming that QC CAs do not use conflicting issuer names
all conforming QCs should be globally unique regardless if they use serialNumber or not.

The serialNumber  is AFAIK just a way to support a [usually static] unique single-attribute
identity concept for a certain subject.  Under some regimes like national ID-systems you may have to
keep this number (string) your whole life, while you some other contexts often will be able to get a new
serialnumber if you feel that you have "worn out" your electronic identity.

The single-attribute identity concept is very suitable for access control systems that have
huge problems coping with a variant set of attributes of arbitrary length and type.
My guess is that this kind of use will be dominant.

Anders

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 1 Dec 1999 08:47:44 -0000

Charles,

>  The serialNumber stuff is just an OPTION (but for certain
>cm> I thought ( based on the current draft)  that serial numbers were used
>to assist in the "unmistakable identity" requirement ( actually like the
>current text)...

The current draft states TWO uses of dnQualifier.  With the serialNumber
addition it does only have to have ONE use.  Differentiator.

It is very unlikely but not forbidden to use both attributes in a certificate.

<snip>

>I believe that the QC profile needs to support both national or
>jurisdictional requirements. 

That is something that I believe all interested parties want.

Anders

---

From: Charles Moore <[email-masked]>
Date: Wed, 1 Dec 1999 19:56:04 +1000

>===== Original Message From Stefan Santesson <SMTP:[email-masked]>
=====
>Charles,
>
>At 04:02 PM 12/1/99 +1000, Charles Moore wrote:
><snip>
>>Back to the past....
>>
>>I am not arguing that serial number or dnq be exclusively used, my
personal
>>preference would be dnq, but rather require we have a standard that
reflects
>>reality and provides a long term solution that can be used by all existing
>>communities...not selective interest groups...
>>
>>I have a problem with overloading of semantics, as they produce
>>indeterminate results...
>>I also dont believe a CP is the means to achieve this, keep the protocol
>>clean and use rules/policy to determine the usage....
>>
>
>One thing that may have to be clarified here is that I have had a dialogue
>with Sharon Boyen, who is involved in the X.509, X.520 and X.521
>standardization, and she claims that they are willing to change the
>definition of serialNumber and related object classes, so that this
>attribute can be used for any type of object.
cm> Who is they?? I have not seen this proposal in the current ITU text, but

then I could have missied it??

>
>Sharon says that this is considered to be a minor adjustment that almost
>was fixed 4 years ago but was forgotten in the process.
>
>This is the fundamental reason for proposing use of serialNumber.
>
>Having this in mind, I fail to see any problems.
>
cm> This issue we are addressing is one of existing usage, not an pure 
stanadards issue, I take some exception to people that change semantics or 
syntax and leave the OIDs the same. X.9.42 DH key as an example ( only
saving 
grace was that there was very little deployments). In the end of the day
these 
fall on the people that build systems....

>
>I' don't want to enter a privacy discussion here, but I just want to stress
>that there is NOTHING in the QC profile that require inclusion of privacy
>sensitive information. In fact, the possibility to use a Pseudonym name is
>clearly stated. 
cm> Pseudonyms are not the issue...

The use of a unique identifier doesn't necessarily means
>that it is privacy sensitive. That depends completely what you can do with
>that number.
cm> If all certs must have an unique identifier then one CANNOT control the 
usage of the number.... I understand the requirement for uniqueness or I 
prefer disabiguation information, just want to be sure it has the right 
objective...
Hence the semantics of the proposal....

>
>The fact is that we need to add support for inclusion of such identifiers,
>regardless of their actual content.
cm> Why??

>
>/Stefan
>-------------------------------------------------------------------
>Stefan Santesson                <[email-masked]>
>Accurata AB                     http://www.accurata.se
>Slagthuset                      Tel. +46-40 108588
>211 20  Malmö                   Fax. +46-40 150790
>Sweden                        Mobile +46-70 5247799
>
>PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
>-------------------------------------------------------------------

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 1 Dec 1999 11:17:35 +0100

Charles,

<snip>

usage of the number....

They don't.  This is just a "feature" that some QC-implementations (profiles) require.

If unique identifiers are bad or good is outside of the QC-draft.  The technical reasons
for using them are pretty clear.    As well as the possible consequences as you point out.

Regarding the changed serialnumber semantics: Does it break any existing code?
I can hardly see that.

Anders

---

From: Sharon Boeyen <[email-masked]>
Date: Wed, 1 Dec 1999 13:02:47 -0500

Just to clarify,

My comment was based on a conversation with Hoyt Kesterson who chairs 
the X.500 group. We both agree that this could be a minor defect. However,
we can't speak for the group and a defect report would need to be submitted,

reviewed and ballotted before we could be sure of the support for it.

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]]
Sent: Wednesday, December 01, 1999 4:38 AM
To: Charles Moore; 'Anders Rundgren'; 'Tony Bartoletti';
[email-masked]
Cc: David P. Kemp
Subject: RE: unqualified topic - not solved yet.

Charles,

>Back to the past....
>
>I am not arguing that serial number or dnq be exclusively used, my personal
reflects

clearly stated. The use of a unique identifier doesn't necessarily means

/Stefan

---

From: Charles Moore <[email-masked]>
Date: Thu, 2 Dec 1999 10:38:42 +1000

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Wednesday, 1 December 1999 20:18
To: [email-masked]'; 'Stefan Santesson'; 'Tony Bartoletti'; 'Charles
Moore'
Cc: 'David P. Kemp'

Charles,

<snip>

They don't.  This is just a "feature" that some QC-implementations
(profiles) require.

If unique identifiers are bad or good is outside of the QC-draft.  The
technical reasons
for using them are pretty clear.    As well as the possible consequences as
you point out.

cm> My point was that the QC profile must not require that the "feature" is
always populated... I belive that you agree....

Regarding the changed serialnumber semantics: Does it break any existing
code?
I can hardly see that.

cm> See assocaited email, that provides an example (not mine)....

Anders