Subject: identifying and indexing certs, was Re: X.509 ACs ...

From: Ed Gerck <[email-masked]>
Date: Tue, 01 Jun 1999 15:57:28 -0700

>
> "Aram Perez" <[email-masked]> on 05/28/99 01:12:30 PM
>
> To:   [email-masked], [email-masked]
> Subject:  Re: X.509 ACs vs. SPKI?
>
> This also begs the question "Why the hash and not just the IssuerSerial?" It
> might be my misunderstanding of X.509, but I was under the
> impression/assumption that the Issuer and Serial Number uniquely identified
> an X.509 certificate.
>

Aram:

If you are willing to restrict yourself to X.509 certs and: (1) trust the issuer
to always use unambiguous SNs; (2) trust the issuer name to be unambiguous;
(3) trust the issuer name to be correct and authoritative; etc. -- fine. Otherwise,
since these previous items are not under my control and I may receive certs
that are not X.509 issued, I prefer to consider that a cert is equal to another
iff their cryptographic hashes are equal.

Of course, *afterwards* (and I guess this answers Steve's concerns about
easy of indexing) I can perfectly well use the cert's Issuer and Serial Number
for indexing purposes or any other non-X.509 index it may have.

However, for security reasons, I may wish to self-sign that cert first -- in
other to prove to myself at a later time that I indeed approved that cert
into my trusted basis. At the same time, I can designate a trust level to
that cert -- so that, later on, my software can automatically use that cert within
my pre-defined reliance limits. And, of course, I will also at the same time
assign a lifetime to my signature -- so that my software can later on also
decide when my assigned trust on that cert needs to be renewed. And yet,
all this can still be reliably indexed by the original cert's Serial Number and
Issuer name.

Thus, exactly because of my distrust on (1), (2), (3), etc. above, I am
able to actually improve my trust on certificate uniqueness -- while not
losing and also improving my trust on the indexing benefits of its Serial
Number in a hierarchical tree. And, at the same time, providing for
interoperation with other standards or special needs even in X.509.

Cheers,

Ed Gerck