Subject: RE: Qualified Certificates draft - Country name

From: [email-masked]
Date: Mon, 1 Mar 1999 19:45:58 -0500

My responses are indicated with my name in brackets.

Tony Bartoletti <[email-masked]> on 03/01/99 06:55:38 PM

To:   Tom Gindin/Watson/IBM, Stefan Santesson <[email-masked]>
cc:   "Bob Jueneman" <[email-masked]>, [email-masked],
      ietf-pkix <[email-masked]>, Stephen Kent <[email-masked]>
Subject:  RE: Qualified Certificates draft - Country name

At 05:30 PM 3/1/99 -0500, [email-masked] wrote:
>     I think that country name should be made mandatory.  If country name
>is made optional, how is the number of first-level entries in the global
>directory tree going to be held down to navigable levels?  I would have no
>objection to defining the mandatory attribute superior to organization as
a
>choice between country name and international assignment authority, but to
>allow any organization that wishes to assign itself as a first-level entry
>in the tree to do so will produce a situation in which there is no entity
>with a complete list of first-level entries.  That would probably make it
>permanently impossible for client systems to navigate the tree.
>     One problem with country name, however, is that it implicitly assumes
>a "Westphalia model" of countries and makes no provision for such things
as
>the EU.  Does anyone know of an alternative attribute that organizations
>could be made subordinate to?

Signs of the Zodiac?  Elements of the Periodic Table? ...

Pardon for being flip, and perhaps a bit mystified by the urge to
subordinate
all things to "countries".  I think of the Balkans, or other areas of the
world
where maps and countries seems to transform themselves on a regular basis.

[Tom Gindin]   No argument here - I was thinking more about the multiple
levels of government than about their stability, though.

Client systems required to navigate a global directory must be pre-armed
with
information sufficient to locate a unique "leaf" in the tree.  Since the
only
real "naming" authority becomes the CA (in negotiation with the certified
party)
it would seem they can be free to select any top-level name from some set
of
pre-established "top-level" names (pre-established for reasons of
efficiency
only).  Hence if "Atomic Elements" were the established top-level names, a
CA
could select one at random and assign it as the first identifying "element"
in my certificate (if the goal were simply to make directories
"navigable".)

Why, exactly, is there a need to have THESE names correspond to anything in
the "real world"?  As long as an entity can be uniquely defined, it would
be
the corresponding CA who should hold whatever information about the entity
that might reveal the qualified "real-world" attributes.

[Tom Gindin]   The problem I see is that a client performing a verification
needs to find the issuing CA (not just its own CA) itself.  The main reason
to have these names correspond to something sizable in the real world is to
keep the number of top-level names manageable, and to have a defensible
basis for allowing certain entities to be at the top level and others not.
Since the set of major industries is roughly as stable as that of
countries, if assignment authorities for them could be as clearly
determined, they would be reasonable candidates for top-level entries - if
somebody could impose a lower bound on what is a "major industry".

Indeed, why should I, and my next-door neighbor, reside "near each other"
in
some global directory?  The very thought is chilling, to say the least.

If I have this all wrong, please straighten me out.

Thanks.

___tony___

Tony Bartoletti                                             LL
Center for Information Operations and Assurance          LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 303                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8002               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL

---

From: Tony Bartoletti <[email-masked]>
Date: Mon, 01 Mar 1999 18:29:57 -0800

At 07:45 PM 3/1/99 -0500, [email-masked] wrote:

[I (Tony) wrote]
>Hence if "Atomic Elements" were the established top-level names,
>a CA could select one at random and assign it as the first
>identifying "element" in my certificate (if the goal were simply
>to make directories "navigable".)
>
>Why, exactly, is there a need to have THESE names correspond to
>anything in the "real world"?  As long as an entity can be uniquely
>defined, it would be the corresponding CA who should hold whatever
>information about the entity that might reveal the qualified
>"real-world" attributes.
>

I understand that there need be a pre-arranged, limited number
of top-level (and why not second and third level) names to afford
efficient directory navigation.

But I cannot see why the directory-search hierarchy should have ANY
relationship to a possible real-world identification "taxonomy".
That is just asking for headaches, and security-related problems.

If I entered into a transaction with you, online or off, and you need
to determine the authenticity of my credentials, I MUST cooperate to
some degree.  If you do not know my "country", for instance, then a
directory with "country name" at the top is of no use to you.

In order for you to find my "issuer", I must supply you with some
information.  It will either be sufficient information for you to
locate my issuer, or it will not.  Once you know that my issuer is
(say) VeriSign, you can validate my QC and be satisfied.

I find the concept of having the directory hierarchy itself mirror
my "identification taxonomy" to be disturbing.  It appears designed
less for "leaf location" and more for "opportunistic trawling".

(I know her name, she lives in Germany, and works for XYZ GMBH.
Let's see if we can locate her QC and find out more about her...)

I know its late in the game, but since it is MY issuing CA who
must vouch for my QC, all they need is to ensure they can place
its location in the directory unambiguously, while the directory
is structured so that inefficient "clumping" does not occur.

If the top 4 levels of the directory were organized according to
4 arbitrary "bytes", then "P.Q.R.S.VeriSign.whatever-else" would
be sufficient to locate my issuer and validate my QC.  The fact
that my neighbor (same street, same country, same organization)
has a QC located by "E.R.G.B.VeriSign.whatever-else" should pose
no problem at all.  Now, any CA can simply generate 4 random bytes
and assign them as the top-level "names" for the cert.  After all,
it serves to point back to the CA, who must vouch for that cert's
"whatever-else" information.

Why should they always be the same, just because they are the
same CA, or for next-door neighbors, or whatever else might be
similar?  

By this scheme, the top-levels of the directory are ALWAYS fixed
and manageable.  And what more defensible basis for allowing "who"
gets to be at the top-levels?  Simply bytes.  They cannot argue,
and no one "owns" them.

The "Cert-Recipient" (Relying Party) needs to have the top-level
name (and more!) in any case, in order to use the directory.
Where are they expected to get this information?  They will
certainly not be making blind-guesses (and you don't want them
to try.)  Either they have a "name" to apply, or they do not.

Am I missing something critical? (wouldn't be the first time;)

___tony___

Tony Bartoletti                                             LL