Subject: QC certificates MAY CERTAINLY be compared!

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 25 Oct 1999 17:55:47 +0100

Stefan,
I have said it before and I say it again.  The following QC-statement is higly doubtful:

"Comparing two qualified certificates to determine if they represent
 the same physical entity may provide misleading results and should
 not be performed"

As you know our famous (?) SEIS-card does indeed allow certificates to
be compared for subject identity.   That is IMO the whole (and only) point with *real* ID-cards!

So this is a statement of the CPS.  Not of the draft.

BTW, why no explicit support for "container ID" (card serial) as most QCs will be
put in smart cards?  It was in SEIS already.

Anders

-----Original Message-----
From: Stefan Santesson <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Monday, October 25, 1999 14:14
Subject: New submitted draft for Qualified Certificates

>All,
>
>A new draft for a Qualified Certificates Profile was submitted friday 22.
>
>The new draft can be obtained from:
>http://www.accurata.se/QC/documents/draft-ietf-pkix-qc-02.txt
>
>The QC website has been udated accrodingly:
>http://www.accurata.se/QC/
>
>See also under settled topics to obtain information about major
>considerations since the last draft.
>
>/Stefan
>-------------------------------------------------------------------
>Stefan Santesson                <[email-masked]>
>Accurata AB                     http://www.accurata.se
>Slagthuset                      Tel. +46-40 108588              
>211 20  Malmö                   Fax. +46-40 150790              
>Sweden                        Mobile +46-70 5247799
>
>PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
>-------------------------------------------------------------------
>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 26 Oct 1999 00:01:12 +0200

Anders,

This is a consequence of the profile, not an opinion of utilization.

If you have two certificates issued by different issuers, and you compare
these certificates and find differences in the subject names, then you may
not be able to tell if these certificates are issued to the same individual
or not. At least not on the basis of what is defined in the QC profile.

This does not mean that you can not do name comparison in a "controlled
environment" based on some other knowledge.

/Stefan

---

From: Russ Housley <[email-masked]>
Date: Wed, 27 Oct 1999 16:40:55 -0500

What goes into the QC when a person is a citizen of more than one country?

Russ

---

From: Stefan Santesson <[email-masked]>
Date: Fri, 29 Oct 1999 23:20:25 +0200

You can store as many citizenship countries as you like (in the personal data
field).

3.2.1 states:

   The countryOfCitizenship attribute SHALL, when present, contain the
   identifier of at least one of the subject's claimed country of
   citizenship at the time that the certificate was issued. If the
   subject is a citizen of more than one country, more than one country
   MAY be present. Determination of citizenship is a matter of law and
   is outside the scope of this document.