Subject: RE: unqualified topic - not solved yet.

From: Charles Moore <[email-masked]>
Date: Wed, 1 Dec 1999 10:52:40 +1000

comments in line...

-----Original Message-----
From: Stefan Santesson [mailto:[email-masked]]
Sent: Wednesday, 1 December 1999 10:20
To: Charles Moore; [email-masked]
Cc: David P. Kemp
Subject: Re: dnQualifier topic - not solved yet.

Charles,

You wanted me to address your issues. Well I regard David's reply here as a
good expression of my view as well.

/Stefan

At 06:46 PM 11/30/99 -0500, David P. Kemp wrote:
>
>> From: "Charles Moore" <[email-masked]>
>> 
>> So if nobody strongly object to this I will go ahead and include this in
>> the QC profile and I assume that rfc 2459 will be updated accordingly
>> 
>> cm> I object for the reasons previously outlined.. You are using it with
the
>> wrong sematics and it will be impossible to distinguish from previous
usage
>> that has the correct semantics...
>> Please address these issues...
>
>Charles,
>
>I don't understand this objection.  If X.520 is modified as suggested
>(so that serialNumber applies to person objects as well as device objects),
>what is "incorrect" about the semantics? 
Problem: a) there are existing implementation of serial number. From the
current standard:
"5.2.9	Serial Number 
The Serial Number attribute type specifies an identifier, the serial number
of a device. 
An attribute value for Serial Number is a printable string. "..
Clearly the standard does not cover your requirement today...
Should the ITU change the semantics of the serial number to be as above,
they had better change the OID!! otherwise the protocol is broke....
This amounts to defining a new attribute, where we started from...

  To my American English ear :-),
>the word "serialNumber" when applied to a person means the same thing
>as "employee number" or "customer number" when applied to a person, or
>"VIN" when applied to an automobile.  The word "number" shouldn't be
>the problem - even when applied to devices such as modems and
>lawnmowers, serial numbers are generally alphanumeric, not purely
>numeric.

cm> This approach is a) hard to intepret from the standard, and if this
stretch is made for serial number then it can also be applied to
dnQualifier...b) the result does no meet the requirement see my previous
email on this subject...

>
>What incompatibility or problem with existing usage would be caused by
>adding "person" to the class of objects to which serialNumber applies?

cm> Why add when there are already classes that include Dnq, and what you
propose does not fix the problem, refer to above rational...

>
>
>
>> The proposal was previously presented as:
>> > I suggest that we:
>> >
>> > - Add serialNumber to son of rfc2459 supportedAttributes as a MUST
>> > implement attribute (i.e. compliant applications MUST be able to
>> understand
>> > it).
>> cm> See above this is not possible given existing usage...
>> Also please address the usage and privacy issue....
>
>What privacy issue?  There is nothing that implies a serialNumber attribute
>must be a National ID (or a Global ID); more likely it will be unique
>per issuer. 
cm> I would respectfully submit that serial number and uniqueness are part
of the semantics... Remember this si a standard existing attribute, in use
today....

 Your customer number from Land's End Direct Merchants is
>different from your driver's license number, your bank account
>number(s), and your brokerage account number(s), and your employer's
>retirement account number.

cm> Need to explain further, I dont understand the point...
>
>Your proposed new attribute would be no different from serialNumber from
>a privacy perspective - privacy is affected by the scope of uniqueness
>(the number of databases which know you by a particular identifier),
>not by the choice of attribute OID.

cm> Sorry, you are not correct... We need to uniquely differentiate people
using a unique identifier, this does NOT imply that all people that receive
qualified certificates MUST have an unique identifier... this is very
important.... We have a culture that goes to great lengths ( including legal
protection) preventing the application of unique numbers to people)... 
>
>
>> > It would help to get your immediate support for this. Can you live with
>> it??
>> 
>> cm> No...
>
>So far the consensus for serialNumber seems smooth, with only one nay.

cm> Is this an international standard or not, consensus is not based on
volume of a few...
End soap...

-------------------------------------------------------------------
Stefan Santesson                <[email-masked]>
Accurata AB                     http://www.accurata.se
Slagthuset                      Tel. +46-40 108588              
211 20  Malmö                   Fax. +46-40 150790              
Sweden                        Mobile +46-70 5247799

PGP fingerprint: 89BC 6C79 5B3D 591B 8547  1512 7D11 DBF4 528F 29A0
-------------------------------------------------------------------

---

From: Tony Bartoletti <[email-masked]>
Date: Tue, 30 Nov 1999 17:35:11 -0800

All,

At first, I didn't understand Charles' objection at all.  Other than
a philosophic objection to being treated as a "device", the "serialNumber"
seems to fulfill the intended purpose.  Indeed, I would like Charles to
elaborate just a bit on how the "wrong semantics" would now conflict
with the "right semantics" already in use.  Concrete examples if possible.

While also swayed by Peter's "only unique-per-issuer" argument, there
are some subtle differences.  I can certainly go from one bank to another
and obtain a new "customer account number".  But however I change my state
of residence, each state expects my car (if it is the same car) to be
registered with the same VID (vehicleID) it always had, no exceptions.

Now, to my understanding, QCs dream of maintaining this same degree of
association to my ... me.  And so long as this QC contains only "soft"
references to "me", no real problem.  But when biometric elements are
included, it becomes quite a bit more like a chassis-stamped VehicleID,
and able to be "globalized" independent of the originally local intent.

But this is more a complaint about the QC-uniqueness concept per-se.
If you go with it, then "serialNumber" seems to hit the mark precisely;)

Comments?  

___tony___

Tony Bartoletti                                             LL
IOWA Center                                              LL LL
Lawrence Livermore National Laboratory                LL LL LL
PO Box 808, L - 089                                   LL LL LL
Livermore, CA 94551-9900                              LL LL LLLLLLLL
phone: 925-422-3881   fax: 925-423-8081               LL LLLLLLLL
email: [email-masked]                                   LLLLLLLL