Subject: Re: Permanent identifiers in QC

From: [email-masked]
Date: Thu, 30 Mar 2000 18:40:08 -0500

I have a counter-proposal.  Given the profile defined for
serialNumber, and the definition of SemanticsInformation in draft section
3.2.5.1, a semanticsIdentifier known as
id-qcs-identifierAssignmentAuthority should be assigned with the following
rules of interpretation: either one or two name registration authorities
must be present, and the first one present shall be interpreted as the
authority governing the name space, while the second (optional) one may
contain the serial number or other unique identifier; if there is only one
name registration authority present, the unique identifier is assumed to be
the serial number attribute of the subject name if there is a serial number
attribute in it, and the first serial number attribute encountered in the
subject alternate name if there is none in the subject name.  Another
semanticsIdentifier known as id-qcs-CALocal should be assigned to identify
serial numbers assigned locally within the CA.  Optionally, a
semanticsIdentifier known as id-qcs-nationalIdentifier might also be
assigned with the rule that when one searches for the serial number in the
subject name and subject alternate name in the same way as for identifier
assignment authorities with only one name registration authority, the
serial number shall be interpreted as being assigned by the country given
in the DN where the serial number is found.

          Tom Gindin

"Stefan Santesson" <[email-masked]> on 03/30/2000 01:49:44 AM

To:   <[email-masked]>
cc:
Subject:  Permanent identifiers in QC

The PKIX meeting in Adelaide raised only 1 issue related to the QC draft.

This issue is whether we should include a new name form in the
subjectAltName extension holding  a permanent identifier.

The permanent identifier would then be a name of the subject, unique within
the issuers domain, that is not reused over time for another subject.

The reason to include such a name form would be that the use of
serialNumber in DN, or directoryName in subjectAltName extension, does not
explicitly define this property by itself, unless seen in the light of a
defined policy etc.

Chair Stephen Kent decided that the decision whether or not to include this
name form in QC should be taken to the list.

My observation in regards to this is:

1) Adding this name form would add confusion to the QC specification since
it would overlap use of serialNumber in the DN.

[Tom Gindin]   Why would this cause confusion if the name form itself had
the same syntax as a DN, and the identity were in the serialNumber
attribute of that name?

2) Use of DN attributes covers all needs related to identification of the
subject, and that's all we need to support electronic signatures, at least
as seen from the EU-directive. And as far I know, this goes for any other
legal system.

[Tom Gindin]   This does not cover the joint specification of an ID and an
assignment authority.  A single ID field with quasi-arbitrary values
similar to a serial number has meaning primarily within the scope of its
assignment authority.

3) Use of DN in combination with either implicit knowledge, use of
Directory name in the subjectAltname ext, use of a related policy
identifier or use of information in the qcStatements extension also provide
support for use of permanent identifiers identified as such.

[Tom Gindin]   No rule for implicit knowledge which would permit an
arbitrary RP to recognize a permanent identifier and its assignment
authority within a DN (whether subject name or alt name) has yet been
received with favor.  However, it should be possible to do this using the
semanticsIdentifier.

4) In each and every case raised in favor of this new name form, the
benefit relates to access control rather than electronic signatures.

[Tom Gindin]   Allowing organizations to assign permanent identifiers of
this type (most usually, but not necesarily, to employees) has roughly the
same impact on signatures as on access control.  If it is assumed that the
identity number is assigned by a governmental or quasi-governmental
authority, then the serial number is sufficient because my above arguments
for assignment authority become irrelevant.

5) This is a new input to the discussion, which before adoption must be
reviewed by the community over some time.

[Tom Gindin]   It has been under discussion for months.

Observation 4 makes this whole discussion outside the scope of QC and in
combination with the other observations, I would request that the QC is
moved forward to proposed standard without this new name form.

[Tom Gindin]   If QC requires that the serial number be assigned either by
a governmental or quasi-governmental authority as a permanent identifier or
by the CA as a tiebreaker, and that the certificate itself contain
somewhere an indicator of whether the name is a permanent identifier or a
tiebreaker, then this name form would not be relevant to QC's.  Otherwise
it would.

If PKIX at a later stage would find that a permanent identifier solution,
as discussed here, is of general value, then this can be moved forward as a
separate item. At that time we would also know if it should be merged with
RFC 2459 or the QC profile, if merged at all.

/Stefan

---

From: "Stefan Santesson" <[email-masked]>
Date: Fri, 31 Mar 2000 21:15:54 +0930

Tom,

Using this extension to contain subject name information would break the
intent of this extension.

/Stefan

> -----Ursprungligt meddelande-----
> Från: [email-masked] [mailto:[email-masked]]
> Skickat: den 31 mars 2000 09:10
> Till: Stefan Santesson
> Kopia: [email-masked]
> Ämne: Re: Permanent identifiers in QC
>
>