Subject: QC - Unmistakable Identity Attributes

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 11 Aug 1999 21:32:55 +0100

Pardon me, I have probably just read the QC draft badly (but repeatedly), but I just 
can't figure out if an attribute that according to the QC-draft CAN be used to uniquely
identify a subject, always MUST be used to create the unique identity. I hope not.
Or is this a part of the CPS to define which of the specified attributes that should
be used to uniquely identify a subject?

Section 4 security 
<snip> 
     Finally, matching rules are not specified for the new attributes 
     defined in the PersonalData field. It is not expected that two quali- 
     fied certificates would be compared to determine if they represent 
     the same physical entity. Such a comparison may provide misleading 
     and should not be performed. 
<snip>

1. Skip "new" in the first paragraph, as it is only "new" at this pre-standard stage. 

2. I don't understand the rest. If applied to let's say a typical ID-card program 
I would say the statement is wrong. I think that a major point with unmistakable 
identity is to be able to have a long-lasting certificate-based relationship without 
any hassles for RPs and subjects.  If identity is allowed to change for a subject
it is a part of the CPS and if a comparision is possible or not is then outside the
scope of the draft (which BTW should be mentioned).

Anders

---

From: Stefan Santesson <[email-masked]>
Date: Sun, 15 Aug 1999 13:40:59 +0200

Anders,

I have problem understanding your question. Do you mean the subject field
or the PersonalData field (in subjectAltName extension)?

In the subject field the attributes SHALL form a distinguished name
(X.500). If this is sufficient in order to establish an unmistakable
identity (that by unmistakable means relates to a person), the Personal
Data field may be omitted.

In the PersonalData field, the attributes must form an unmistakable identity.

So the answer to your question is that the attributes in the subject field
does NOT have to form an unmistakable identity if the PersonalData field is
used to serve that purpose.

/Stefan