Subject: Re: QC certificates MAY CERTAINLY be compared!

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 26 Oct 1999 04:31:14 +0100

Stefan,

1. The QC statemnent in question does not mention *different* issuers

2. The statement is still incorrect when applied to SEIS-cards from different
issuers as unique identity in those is "person-number" and nothing else.  Name is volatile.
I.e. SEIS-certs may very well be compared but you must restrict the comparision to
the attributes that form the STATIC and unique identity.  Regardless if the certs
are issued from the same or different issuers.

3.  No comments to the Container-ID stuff?

/Anders

-----Original Message-----
From: Stefan Santesson <[email-masked]>
To: Anders Rundgren <[email-masked]>; 'SEIS-List' <[email-masked]>; [email-masked] <[email-masked]>
Cc: Magnus (RSA) <[email-masked]>
Date: Monday, October 25, 1999 22:56
Subject: Re: QC certificates MAY CERTAINLY be compared!

Anders,

This is a consequence of the profile, not an opinion of utilization.

If you have two certificates issued by different issuers, and you compare
these certificates and find differences in the subject names, then you may
not be able to tell if these certificates are issued to the same individual
or not. At least not on the basis of what is defined in the QC profile.

This does not mean that you can not do name comparison in a "controlled
environment" based on some other knowledge.

/Stefan

At 17:55 1999-10-25 +0100, Anders Rundgren wrote:
>Stefan,
>I have said it before and I say it again.  The following QC-statement is 
>higly doubtful:
>
>"Comparing two qualified certificates to determine if they represent
> the same physical entity may provide misleading results and should
> not be performed"
>
>As you know our famous (?) SEIS-card does indeed allow certificates to
>be compared for subject identity.   That is IMO the whole (and only) point 
>with *real* ID-cards!
>
>So this is a statement of the CPS.  Not of the draft.
>
>
>
>BTW, why no explicit support for "container ID" (card serial) as most QCs 
>will be
>put in smart cards?  It was in SEIS already.
>
>
>Anders
>
>
>-----Original Message-----
>From: Stefan Santesson <[email-masked]>
>To: [email-masked] <[email-masked]>
>Date: Monday, October 25, 1999 14:14
>Subject: New submitted draft for Qualified Certificates
>
>
>>All,
>>
>>A new draft for a Qualified Certificates Profile was submitted friday 22.
>>
>>The new draft can be obtained from:
>>http://www.accurata.se/QC/documents/draft-ietf-pkix-qc-02.txt
>>
>>The QC website has been udated accrodingly:
>>http://www.accurata.se/QC/
>>
>>See also under settled topics to obtain information about major
>>considerations since the last draft.
>>
>>/Stefan
>>-------------------------------------------------------------------
>>Stefan Santesson                <[email-masked]>
>>Accurata AB                     http://www.accurata.se
>>Slagthuset                      Tel. +46-40 108588              
>>211 20  Malmö                   Fax. +46-40 150790              
>>Sweden                        Mobile +46-70 5247799
>>
>>PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
>>-------------------------------------------------------------------
>>

---

From: Stefan Santesson <[email-masked]>
Date: Sat, 30 Oct 1999 00:01:27 +0200

Anders,

Thank you, I have noticed your comment.

The security considerations section contains CONSIDERATIONS for the general
case and I still believe in the intent behind this sentence, as a good
general guidance to implementations. 

Setting up implementations with the intent to compare two qualified
certificates to see if they represent the same person IS generally a bad
service that shouldn't be performed. Since in the general case, you will
have clear risk of misleading results.

Well, if you leave the general case and go into speciffic cases such as
comparing SEIS certificates within a local region (such as Sweden), then
there will allways be cases where some security considerations does not
apply (such as this particular one).

I think this is a minor issue within the security consideration section
which does not affect the implementation of the profile. Shure there are an
even better way of expressing the original intent behind that sentence. But
on the other hand,  there will allways be a better way of everything.

I think the present description is good enough. Can you live with it ?

/Stefan