Subject: QC: VERISIGN uses UIDs!

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 7 Nov 1999 15:31:41 -0000

Hi,
Just to make sure that you get the message that the commercial world (in spite
of what has been said on this list and SHALL NOTs in RFC2459) actually
need (and already use) unique identities of the kind that I propose.  

http://www.verisign.com/press/1999/partner/eccelerate.html

A 59M+ possible market!!!  So there are not only a few "disturbed, morons" like
me who require this.

>From a trusted source I have heard that unique identifiers also will be the case for WAP-certs.
Du U really think that you for each cert renewal will get a new UID?  That would
be as clever as getting new telephone numbers all time!

So if RFC2459 says SHALL NOT and QC-002 says certificates can't be compared,
the commercial world appararently does not give a s**t about that.

So why not adapt QC for COMMERCIAL needs and make this a described
and supported feature as well???

And maybe the revised 2459 as well?

Anders

-----Original Message-----
From: Anders Rundgren <[email-masked]>
To: 'SEIS-List' <[email-masked]>; 'Stefan Santesson' <[email-masked]>; [email-masked] <[email-masked]>
Cc: Magnus (RSA) <[email-masked]>
Date: Friday, November 05, 1999 17:27
Subject: QC UID support must depart from RFC2459

>
>>Stephen Kent <[email-masked]>
>>
>>In version 2 X.509 certs there was a field added for unique subject and
>>issuer IDs.  It was a bad idea, designed to address what appear to be some
>>of the issues you alluded to above; nobody uses it.  I don't think we
>>should include a similar facility in a QC.  You'll note that 2459
>>explicitly disparages use of the v2 UIDs.
>
>
>It is not hard to see why SEIS made a private profile given all the pointing fingers rubbish
>with (totatlly unmotivated) SHALL NOT etc.
>
>In order to support unique identity IDs in a CONFORMANT way there is no other way
>(due to RFC2459) than to REDEFINE this in QC.
>
>It cpuld be a new extension or reconsidered old one.  As "nobody" used the old one
>I think a new one according to the ANSI/WIM-lines should be most appropriate.
>
>Like OCTET STRING (1..16)
>
>Anders
>
>
>
>

---

From: Stephen Kent <[email-masked]>
Date: Tue, 9 Nov 1999 17:29:24 -0500

Anders,

If we followed VeriSign's behavior re certificate syntax, we would 
also encourage e-mail names hacked into DNs, CPS text embedded in 
certificates, etc.  I'm afraid I don't consider VeriSign to be the 
reference standard for certificate syntax.

Steve