Subject: Re: dnQualifier

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 13 Nov 1999 08:36:57 -0000

Ella, 
It seems that the issue is addressed by this group (PKIX) but I see no signs of 
consensus on a new interpretation on dnQualifier. At least not by reading the 
PKIX-postings.  

Personally I think that the feature requested (which is different than just distinguishing between 
entities with similar name) should get a new fresh attribute or extension. Its connection to 
X.500 directories is outside of my competence (I believe this feature will mostly be used in 
non-directory-oriented systems like access control, e-commerce and Internet-banking). 

In such systems a subscriber is usually reduced to a number and things like "Name",
"Gender", "Address" are  simply attributes that are used for display purposes and/or human
verification. 

As seen by some recent postings on this subject a lot of parties have already 
deployed their own style of "static unique identity string" 

It would of course be great for future interoperability if the lowest-level 
document (X.509 FPDAM?) supported such feature.

Anders