Subject: RE: Certificates, Directories, and Distinguished Names

From: Alan Lloyd <[email-masked]>
Date: Tue, 6 Apr 1999 12:57:23 +1000

Some comments -

> -----Original Message-----
> From:	Stephen Kent 
> Sent:	Tuesday, April 06, 1999 3:49 AM
> To:	Alan Lloyd
> Cc:	[email-masked] ' '; [email-masked] ' '
> Subject:	RE: Certificates, Directories, and Distinguished Names
> 
> Alan,
> 
> >My question was really aimed at the cert extensions subject - issuer
> alt
> >names.. I still dont understand what and why these are in the cert -
> if
> >its baggage for some obscure reason - then thats OK - but if its for
> >validation process issues - then they have to be spelled out. And if
> >they are just baggage, instead of making them  "alt name forms"- why
> not
> >call then subject and issuer additional info or in fact just make
> them
> >cert ext directory attributes?
> >
> >We seem to have in these extensions, a lot of form without content.
> 
> Alt names allow a PKI to use name forms most closely aligned to the
> application context with which the certs will be used. That, by
> itself, is
> sufficient reason to provide them. 
> 
	This can be agreed with or:

	Say I get a cert/key from Honest John cert co - and its
recognised by a few dozen traveller kiosks around the country and toll
plazas on freeways.
	 When I use it from the car, the email address of the
transaction is toll booth 23@ Tullamaine -free way. roads and when I go
bush... another one day  the email address is
[email-masked]

	It strikes me that nailing, cryptographically, information in a
certificate that may or may not get used could be a hinderance not a
benefit..

	As you are aware by now OpendDrectory - *(opendirectory.com) got
bought by Platinum Technologies (platinum.com) who have justy been
bought by CA (ca.com) -- so whats the key management issues eh! 

	It also strikes me that the last place I want my mail address is
in my certificate - as this will create and compound any archive and
rekey issues.

	I just dont believe in making a certficate a replacement for
directory entry (because the processes that use certificates dont have a
directy service) - when the certficate was designed to work within the
framework of processes that used directory services. Simply because -
its the human/operational side that will have to deal with the issues -
and companies - first and foremost want less operating costs and bigger
systems.

	To date - few have able to explain a real benefit of these alt
names - and even fewer have dealt with the dynamics of cert/key re
issuance and archive because of these extra attributes and their
implications with domain agile devices, working into multi domain
business environments..

	Oh well..

	regards alan
> Look at the messes created by shoe
> horning DNS names into DNs in SSL certs, or e-mail addresses into DNs
> in
> S/MIME.  We can't go back and change the Subject and Issuer to be
> GeneralNames due to backward compatability constraints, so ...
> 
> Steve

---

From: Stephen Kent <[email-masked]>
Date: Tue, 6 Apr 1999 10:42:00 -0400

Alan,

>[email-masked]

Gee, you Aussies really like to send mail from out of the way places :-).

We agree that the message recipients care more about who you are than the
origin of a specific message.  However, in the e-mail world, the IDs people
are comfortable with, are e-mail addresses.  S/MIME decided to prefer that
form of ID for their application environment, and so it is appropriate for
PKIX to support it. It is also an ID form supported in IPsec for
individuals.  This is just another case of folks in the Internet choosing
to make use of an existing naming infrastructure, i.e., the DNS, than to
build and rely upon a new one, e.g., X.500.  This is an IETF WG, so this
ought not be surprising!

>certificate that may or may not get used could be a hinderance not a

I'm in favor of not putting too many attributes into a cert; remember
Steve's Rule of Revocation.  But we're really talking about an alternate
Subject name here, not an added piece of info.

	<corporate merger activity advertisement deleted>

>in my certificate - as this will create and compound any archive and

Huh? If the e-mail address is the chosen name form, then learn to deal with it!

<typical Alan text about X.500 as a panacea deleted>

Steve