Subject: RE: Internal conflict in QC profile?

From: Ilan Shacham <[email-masked]>
Date: Mon, 6 Dec 1999 10:58:06 +0200

Hi Magnus,
I see...
If I'm the only one who mis-read that then I guess it's ok...

Ilan

------------------------------------------------------------------------
Ilan Shacham				mailto:[email-masked]
Algorithmic Research Ltd.		http://www.arx.com
10 Nevatim St.,			phone:	972 - 3 - 9279540
Petach-Tikva, Israel			Fax:	972 - 3 - 9230864

> -----Original Message-----
> From: Magnus Nystrom [mailto:[email-masked]]
> Sent: Monday, December 06, 1999 10:51 AM
> To: Ilan Shacham
> Cc: [email-masked]
> Subject: Re: Internal conflict in QC profile?
> 
> 
> 
> Hi Ilan,
> 
> And thanks for your feedback.
> 
> With regards to your question, please note that the paragraph 
> after the
> three choices below refers not only to them but also to all 
> the attributes
> in the list just before your 'snippet'. That is, the dnQualifier (and
> whatever attribute that functionally will replace it) is 
> already included.
> 
> Best regards,
> -- Magnus
> Magnus Nystrom		Email: [email-masked]
> RSA Laboratories
> 
> On Sun, 5 Dec 1999, Ilan Shacham wrote:
> 
> > Hi all,
> > The QC profile, in section 3.1.2 states:
> > 
> >  "  ...Of these attributes, the subject field SHALL include 
> at least one of
> >    the following:
> > 
> >       Choice   I:  commonName
> >       Choice  II:  givenName
> >       Choice III:  pseudonym
> > 
> >    Other attributes may be present but MUST NOT be necessary to
> >    distinguish the subject name from other subject names within the
> >    issuer domain.
> > ...
> > ...
> >    The dnQualifier attribute type SHALL, when present, be used to
> >    differentiate between names where the subject field 
> would otherwise
> >    be identical.  This qualifier has no defined semantics beyond
> >    ensuring uniqueness of subject names.  It MAY contain a number or
> >    code assigned by the CA or an identifier assigned by a 
> government or
> >    civil authority.  It is the CA's responsibility to 
> ensure that the
> >    dnQualifier is sufficient to resolve any subject name 
> collisions..."
> > 
> > It looks to me that the first of these paragraphs should be 
> changed to
> > something like:
> > 
> >    Other attributes may be present but MUST NOT be necessary to
> >    distinguish the subject name from other subject names within the
> >    issuer domain, except for the dnQualifier attribute which may be
> >    used as described below.
>