Subject: Re: NR Signing-Entity vs Certificate-Subject

From: "David P. Kemp" <[email-masked]>
Date: Tue, 23 Nov 1999 10:45:51 -0500 (EST)

> From: "David P. Kemp" <[email-masked]>
> 
> > From: Tony Bartoletti <[email-masked]>
> > 
> > All,
> > 
> > Would it not be more "up front" to refer to the "signing entity"
> > in the NR definition as the "certificate subject"?
> > 
> > Granted, in these circles it may seem to be another one of those
> > "understood" things, but to common folk it might appear a bit
> > disengenuous.
> 
> It would be disengenuous to refer to certificate subject.  "Signing
> entity" or "keyholder" is the proper term, because an engineering
> specification should not make claims it cannot enforce.

To clarify, it would be disengenuous to refer to "the person named in
the certificate".

If by "certificate subject" you mean "the subject field of the
certificate", I agree that there is a binding between the subject field
and the public key field created by the CA signature, a mathematical
correspondence between the public key and the private key, and a
mathematical correspondence between the private key and the signature.
So there is little difference between "signing entity" (possessor of
the private key) and "subject field of the certificate".

But there could be a significant difference between "signing entity"
and "person named in the certificate", so you can't use the term
"certificate subject" without saying whether you mean a DN or a
person.  "signing entity" doesn't suffer from that ambiguity.

---

From: Tony Bartoletti <[email-masked]>
Date: Tue, 23 Nov 1999 10:50:01 -0800

>person.  "signing entity" doesn't suffer from that ambiguity.

True.  But "signing entity" will be commonly construed to mean
"the person who effected the signature" (pushed the OK button).
It is precisely because an engineering specification should not
make claims it cannot enforce that I feel we should avoid giving
the impression that NR somehow targets the "active signer".

In contrast, the term "certificate subject" (yes, how to emphasize
we mean the "Name" and not the "Person"?) tends to reinforce the
notion that the "binding begins here", and all else must follow
from other artifacts.

___tony___ 

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL