Subject: Re: Qualified Certificates and the 43:d IETF Meeting

From: Stefan Santesson <[email-masked]>
Date: Fri, 18 Dec 1998 11:53:20 +0100

We decided during Orlando to go with dnQualifier instead of serialNumber.
It seams that there is a majority supporting that choice.

/Stefan

At 04:14 PM 12/11/98 -0500, Ella P. Gardner wrote:
>Some folks don't like the fact that the X.500 standard unique identifier is
>a bit string. That's why we used dnQualifier in the Allied Communications
>Publication 133.
>
>Ella
>
>At 01:04 PM 12/10/98 -0500, david chadwick wrote:
>>
>>
>>Russ Housley wrote:
>>
>>> Nick & Stefan:
>>>
>>> >>2)The standard attribute dnQualifier could be used instead of
>serialNumber
>>> >>(Th attribute "serialNumber is defined in RFC 2256 as being the serial
>>> >>number of a device).
>>> >>
>>> >
>>
>>The X.500 standard defines a uniqueIdentifier attribute that might be better
>>suited to the semantics than either serial number or dnQualifier.
>>David
>>
>>
>>>
>>> >Yes, the SN is not in complete harmony regarding its definition and its
>>> >use. However several other standardisation proposal has choosen SN for
>>> >personal identifiers. The rationale behind that choice have been that
most
>>> >applications support and displays this attribute in a correct way.
>>> >
>>> >Is there an installed base using "dnQualifier" ?
>>>
>>> We include support of dnQualifier.
>>>
>>> I strongly prefer dnQualifier over serialNumber.
>>>
>>> Russ
>>
>>
>>
>
>
>
-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata Systemsäkerhet AB     
Lotsgatan 27 D                  Tel. +46-40 152211              
216 42  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: Robert Malick <[email-masked]>
Date: Fri, 18 Dec 1998 08:28:11 -0500 (EST)

Excerpts from mail: 18-Dec-98 Re: Qualified Certificates .. Stefan
Santesson@accurat (1834*)

> >a bit string. That's why we used dnQualifier in the Allied Communications

Could someone deny or confirm that what was once "uniqueIdentifier" in
X.500 is now "X500UniqueIdentifier". I belive the name was changed and
the OID is the same as it was thus no conflict.

We are planning to use "uniqueIdentifier" as is defined in RFC 1274 (and
LIPS) in our directory services (as future certificates) and thought
that this point was mute now.

With the latest discussions, I'm not sure now.

	Rob

---

From: [email-masked] (Ella P. Gardner)
Date: Fri, 18 Dec 1998 10:44:06 -0500

Rob:

uniqueIdentifier in X.520 has the same object identifier as
X.500UniqueIdentifier in RFC 2256, paragraph 5.46. They added the X.500
prefix to distinguish it from the uniqueIdentifier defined in RFC 1274.

Ella

---

From: Mark Wahl <[email-masked]>
Date: Fri, 18 Dec 1998 11:20:26 -0600

> that this point was mute now.

RFC 1274 defined an attribute, numbered under the pilot OID space, with 
string syntax called "uniqueIdentifier".  This document was published as a 
Proposed Standard in late '91.

X.520(1993) defined an attribute, numbered under the X.500 space, with 
BIT STRING syntax.  ITU/ISO called this attribute 'uniqueIdentifier'.  

In LDAP, deployments had been using the textual names in RFC 1274.  In
LDAPv3, we wanted to add attributes from X.520(1993) and later. To minimize
conflicts in the string names, in RFC 2256 we assigned a string name 
'x500uniqueidentifier' for the attribute defined by X.520(1993).  Section 5.46
of this document states that this attribute is distinct from both the 'uid'
and 'uniqueIdentifier' attributes, both of which are in 1274.

Mark Wahl, Directory Product Architect
Innosoft International, Inc.