Subject: Pictures in QCs - No problems!

From: Anders Rundgren <[email-masked]>
Date: Sat, 20 Mar 1999 09:56:55 +0100

Tom Gindin wrote:
>  While Anders admittedly knows little about ASN.1, he may be onto
>  something useful here.  What would be wrong with defining a non-critical
>  extension called displayableImage with syntax
>  DisplayableImage ::= SEQUENCE {
>       mime-type PrintableString,          -- I apologize if it's really
>  IA5String
>       body      OctetString
>  }
>       and then trying to get the browsers to support it?  They don't do so
>  yet, of course, but it seems like a good idea and not incredibly difficult.

Thanx Tom for filling in the missing ASN.1!  This was of course exactly what
I meant.

A few clarifications: 

STEPHEN, my reference to browsers was more to say that this data
can be shown (rendered) in a browser but of course the certs themselves must
be DECODED first.  The point is, DisplayableImage is a useful way to express
Pictures and handwritten signatures in a cert.

TOM, the thing you mention regarding non-critical extension is though something
that I would like to do different.  I want a few common biometrics to be added to the
list of standard QC attribute types.  From the draft:

Complying applications SHALL expect any subset of the following defined attribute types 
within a PersonalDataRecord:

countryName;
givenName;
surname;
pseudonym;
dNQualifier;
dateOfBirth;
placeOfBirth;
gender;
postalAddress; 
countryOfCitizenship; 
countryOfResidence;

 +

photo;
handWrittenSignature;

 +

maybe a few other biometrics like fingerprints that are more or less standardized.

                   P  O  L  I  T  C  S  !

Regarding the political aspects of the contents of certs including SSNs and Biometrics,
and the differences in opinions on how PUBLIC Key Infrastructure should be interpreted,
and the sometimes claimed need for global directories I think that we should have this
discussion somewhere else as it must be outside the scope of IETF to judge what you
can do or not do as long as it is not technically inferior.

Politically inferior solutions are market and legislation issues.

I personally don't mind a discussion or two so feel free to mail me!

Anders Rundgren
Senior Internet e-commerce Architect
http://www.mobilephones-tng.com

---

From: [email-masked] (Peter Gutmann)
Date: Mon, 22 Mar 1999 17:41:35 (NZST)

Anders Rundgren <[email-masked]> writes:
 
>>     mime-type PrintableString,          -- I apologize if it's really IA5String
>>     body      OctetString
>>}
 
>STEPHEN, my reference to browsers was more to say that this data can be shown
>(rendered) in a browser but of course the certs themselves must be DECODED
>first.  The point is, DisplayableImage is a useful way to express Pictures and
>handwritten signatures in a cert.
 
I've already had to so something like this before for the MPEG-of-cat 
certificate I created (available from 
http://www.cs.auckland.ac.nz/~pgut001/pubs/dave.der, signed by 
http://www.cs.auckland.ac.nz/~pgut001/pubs/dave_ca.der), why not just handle 
stuff like this as an otherName?  I used the MPEG-1 OID to identify it, and 
the MPEG itself as the value.
 
Peter.