Subject: RE: unqualified topic - not solved yet.

From: "David P. Kemp" <[email-masked]>
Date: Thu, 2 Dec 1999 10:03:24 -0500 (EST)

The current QC profile (draft -02) does not require that any "feature"
be populated  ... how did you get the impression that one particular
attribute might be special-cased in the next draft?

The description of every attribute in the current draft, including
dnQualifier, begins with:

   "The xxx attribute type SHALL, when present, be used to ..."

The description of the Issuer is quite clear:

   "The unmistakable identity of the issuer SHALL be specified using an
   appropriate subset of the following attributes.:"

The description of the Subject is not as clear, but in a roundabout
manner it indicates that the unmistakable identity of the subject is
specified using a set of attributes where no single attribute is
required to be populated.

Dave Kemp

> From: Charles Moore <[email-masked]>
>
> -----Original Message-----
> From: Anders Rundgren [mailto:[email-masked]]
> Sent: Wednesday, 1 December 1999 20:18
> To: [email-masked]'; 'Stefan Santesson'; 'Tony Bartoletti'; 'Charles
> Moore'
> Cc: 'David P. Kemp'
> Subject: RE: unqualified topic - not solved yet.
> 
> 
> Charles,
> 
> <snip>
> 
> cm> If all certs must have an unique identifier then one CANNOT control the 
> usage of the number....
> 
> They don't.  This is just a "feature" that some QC-implementations
> (profiles) require.
> 
> If unique identifiers are bad or good is outside of the QC-draft.  The
> technical reasons
> for using them are pretty clear.    As well as the possible consequences as
> you point out.
> 
> cm> My point was that the QC profile must not require that the "feature" is
> always populated... I belive that you agree....

---

From: "Charles Moore" <[email-masked]>
Date: Fri, 3 Dec 1999 06:36:00 +1000

----- Original Message -----
From: David P. Kemp <[email-masked]>
To: <[email-masked]>
Sent: Friday, December 03, 1999 1:03 AM
Subject: RE: unqualified topic - not solved yet.

> attribute might be special-cased in the next draft?
cm> This email thread...

>snip

cm> This is the point...

As we seem to agree, just need to make the text align...

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 03 Dec 1999 14:15:45 +0100

Charles,

At 06:36 AM 12/3/99 +1000, Charles Moore wrote:
<Snip>
>As we seem to agree, just need to make the text align...

I don't get it.

We seems to agree that no unique identifier must be present.

But where do we have to align the text ?????

If you assume that the term "unmistakable identity" = unique identifying
code in a single attribute, then you must have missed the definition of
unmistakable identity (section 2.4)

  "An unmistakable identity denotes a set of attributes and/or data
   elements, which forms an identity that by unmistakable means relates
   to a specific entity. The unmistakable connection between the
   identity and the entity may be dependent on the context within which
   the name is formed. This context should however be evident for any
   relying party given the information in the certificate. Some
   contexts, such as when identities are based on pseudonyms, may
   require assistance from the CA or a registration authority, to obtain
   a corresponding officially registered identity under some predefined
   circumstances, such as investigation of criminal offence."

So, what is the problem here?

/Stefan
-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata AB                     http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: "Charles Moore" <[email-masked]>
Date: Sat, 4 Dec 1999 06:20:39 +1000

----- Original Message -----
From: Stefan Santesson <[email-masked]>
To: Charles Moore <[email-masked]>; David P. Kemp
<[email-masked]>; <[email-masked]>
Sent: Friday, December 03, 1999 11:15 PM
Subject: Re: unqualified topic - not solved yet.

Charles,

I don't get it.

cm> I agree that a unique identifiy needs to be present, when and only when,
there is a need to disabiguate non unique ( using whatever criteria one
requires) people.
This means that a) there is not a requirenment to populate either Dnq or
Serial number ( the legacy attributes) if there s already unique
identifiaction information present. On a policy basis, these values MAY be
populated subject to national requirements.

Note: The RFC is for open systems, a closed or propriety system may do what
ever it likes, so a company system can make mandatory any of the above, but
this is outside the scope of the RFC...

cm> Make it represent what we agree without ambiguity....

cm> I dont, see above...

cm> Does not address the issue.

/Stefan