Subject: RE: Qualified Certificates draft - Country name

From: [email-masked]
Date: Mon, 1 Mar 1999 17:30:32 -0500

I think that country name should be made mandatory.  If country name
is made optional, how is the number of first-level entries in the global
directory tree going to be held down to navigable levels?  I would have no
objection to defining the mandatory attribute superior to organization as a
choice between country name and international assignment authority, but to
allow any organization that wishes to assign itself as a first-level entry
in the tree to do so will produce a situation in which there is no entity
with a complete list of first-level entries.  That would probably make it
permanently impossible for client systems to navigate the tree.
     One problem with country name, however, is that it implicitly assumes
a "Westphalia model" of countries and makes no provision for such things as
the EU.  Does anyone know of an alternative attribute that organizations
could be made subordinate to?

          Tom Gindin     ([email-masked])

Note: These opinions are mine, and are not necessarily those of my
employer.

Stefan Santesson <[email-masked]> on 02/27/99 10:51:59 AM

To:   "Bob Jueneman" <[email-masked]>, Tom Gindin/Watson/IBM
cc:   [email-masked], ietf-pkix <[email-masked]>, Stephen Kent
      <[email-masked]>
Subject:  RE: Qualified Certificates draft - Country name

All,

I would like to clarify the scope of the draft.

It is NOT the intent of the draft to specify how a meaningful identity
should be composed.

Period.

It is though the intent of the draft to specify a well defined structure
within which any useful identity information could be expressed according
to the issuers and the key holders preferences.

The qualified certificate has two different compartments for subject
identity information.
1) The subject field
2) The PersonalData field (stored in subjextAltName extension as a new
information construct stored under otherNames.)

The main purpose of the subject field is to hold a "technical name"
fulfilling all technical requirements that might be imposed on the
certificate with respect to presence of a unique X.500 type of name. This
name may or may not be suitable as the subjects preferred legal name
(unmistakable identity).

The optional PersonalData field has the main purpose of providing means to
express a legal name in cases where the subject field is not sufficient for
this purpose. The advantage of this approach is to free the subject field
of strange attributes and semantics necessary for expressing the legal
name.

So, this debate is about whether the countryName attribute in the subject
field (the technical name)shall be mandatory or optional. Keep in mind that
any country information as part of the legal name can be handled in the
PersonalData field regardless of what is done in the subject field.

This gives the conclusion that what we decide in the subject field (as
mandatory or not), should only be based on technical requirements from
X.500 directory systems and similar, not from requirements on legal name
forming.

Based on this presumption I would appreciate a consensus in this subject.

/Stefan

-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata Systemsäkerhet AB
Lotsgatan 27 D                  Tel. +46-40 152211
216 42  Malmö                   Fax. +46-40 150790
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: Tony Bartoletti <[email-masked]>
Date: Mon, 01 Mar 1999 15:55:38 -0800

>could be made subordinate to?

Signs of the Zodiac?  Elements of the Periodic Table? ...

Pardon for being flip, and perhaps a bit mystified by the urge to subordinate
all things to "countries".  I think of the Balkans, or other areas of the world
where maps and countries seems to transform themselves on a regular basis.

Client systems required to navigate a global directory must be pre-armed with
information sufficient to locate a unique "leaf" in the tree.  Since the only
real "naming" authority becomes the CA (in negotiation with the certified party)
it would seem they can be free to select any top-level name from some set of
pre-established "top-level" names (pre-established for reasons of efficiency
only).  Hence if "Atomic Elements" were the established top-level names, a CA
could select one at random and assign it as the first identifying "element"
in my certificate (if the goal were simply to make directories "navigable".)

Why, exactly, is there a need to have THESE names correspond to anything in
the "real world"?  As long as an entity can be uniquely defined, it would be
the corresponding CA who should hold whatever information about the entity
that might reveal the qualified "real-world" attributes.

Indeed, why should I, and my next-door neighbor, reside "near each other" in
some global directory?  The very thought is chilling, to say the least.

If I have this all wrong, please straighten me out.

Thanks.

___tony___

Tony Bartoletti                                             LL
Center for Information Operations and Assurance          LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 303                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Paul Koning <[email-masked]>
Date: Tue, 2 Mar 1999 10:33:53 -0500

>>>>> "tgindin" == tgindin  <[email-masked]> writes:

 tgindin> I think that country name should be made mandatory.  If
 tgindin> country name is made optional, how is the number of
 tgindin> first-level entries in the global directory tree going to be
 tgindin> held down to navigable levels?...
 tgindin> Does anyone know of an alternative attribute that
 tgindin> organizations could be made subordinate to?

 tgindin> Tom Gindin ([email-masked])
                                     ^^^
It seems to me you have an existence proof right there that it's not
at all necessary to subordinate names to countries.

	paul

---

From: [email-masked] (Arnoud "Galactus" Engelfriet)
Date: Tue, 02 Mar 1999 21:01:33 +0100

In article <[email-masked]>,
> at all necessary to subordinate names to countries.

The number of .com domains is now well over 3 million. It's hardly
a meaningful top-level domain anymore. The adoption of new top-level
domains has been planned for several years, but there's still no
sign of them coming into effect anytime soon.

So, yes, it's not necesssary to use country names as top-level/
first-level entries, but if you want something else, you're pretty
much on your own with the definition of the classification.

Greetings,

Arnoud

-- 
\/  Arnoud "Galactus" Engelfriet - [email-masked]              This space
    5th year Business & Computing Science student                 left blank
    URL: http://www.stack.nl/~galactus/  PGP: 0x416A1A35      intentionally.