Subject: Re: Can we form certificates with just name and e-mail address

From: "David P. Kemp" <[email-masked]>
Date: Mon, 19 Jun 2000 13:42:52 -0400 (EDT)

> From: Stefan Santesson <[email-masked]>
>
>   ...
>
> Why can't an e-mail address be part of a reasonable DN? (I guess that's 
> what the current text implies)
> 
> /Stefan

DNS is a (the only?) universal-coverage name registration system, and
although one would never know it by examining current X.509
certificates, "reasonable" does not have to mean "beginning with a
Country= RDN".  So one reasonable DN might be:

  "DC=se, DC=accurata, SN=stefan + CN=Stefan Santesson"

This is semantically identical to a null DN and an rfc822Name in the
subjectAltName extension, and if there were an RFC spelling out some
equivalence rules, applications might someday be able to translate
between the rfc822Name format and the RDNSequence format as required.

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 20 Jun 2000 17:55:18 +0200 (MET DST)

Why not using an alternature subject with an
email and the x.509 extension for the name parts. 

Subject directory attributes extension

This field conveyes and desired Directory attribute values for
the subject of the certificate. This field is defined as follows:

 subjectDirectoryAttributes EXTENSION ::= {
     SYNTAX AttributesSyntax
     IDENTIFIED BY id-ce-subjectDirectoryAttributes }

 AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute 

id-ce-subjectDirectoryAttributes :: OBJECT IDENTIFIER ::= {id-ce 9}

---

From: "Bob Jueneman" <[email-masked]>
Date: Thu, 22 Jun 2000 15:46:24 -0600

Steve,

>"Since e-mail addresses are 
already globally unique, what does the given name and surname do for 
you, from a tree structure standpoint?"

Well, e-mail addresses are presumably globally unique, but they are not necessarily
one to one with an identifiable person.  Two or more people may share an
e-mail mailbox, and very often do.  And one person may have more than one 
mailbox, and many do.

Likewise, there may be multiple Steve Kent's, and there might or might not
be multiple c=US, sP=MA, l=Cambridge, cN="Steve Kent".

But presumably there would only be one 
{c=US, sP=MA, l=Cambridge, cN="Steve Kent"}+rfc822="[email-masked]" 

Even so, that DN might be globally unambiguous, but not globally unique.
{c=US, l=Gotham, cN="Clark Kent"}+rfc822="[email-masked]" 
may in fact refer to the same individual.

And both e-mail postal boxes and DNS components can have aliases,
so {c=US, l=Gotham, cN=Superman}+rfc822="Faster Than A Speeding Bullet"@DailyPlanet.com
may also refer to the same person.

Signed,

"Leaps Tall Buildings with a Bound and a Half"@novell.com  :-)

>>> Stephen Kent <[email-masked]> 06/20/00 09:13AM >>>
Stefan,

>Steve,
>
>Thank's for useful input. Just to round this up, can you confirm the 
>conclusion that issuing certificates where subjects are represented 
>by just e-mail address + givenName + surname (and maybe also 
>country) is simply not possible.
>
>The name must simply be combined with a serialNumber attribute or 
>some other information that makes the name (with e-mail address 
>excluded) a reasonable DN.
>
>Right?

Well, its possible to issue certs with any sort of DN.  The question 
is what makes sense given the semantics of a DN, not just viewing it 
as a string of AVAs irrespective of context. The question I would ask 
is what would the directory tree look like given a proposed DN.  How 
would the tree be distributed and managed?  Think about the schema 
with those considerations in mind.

For example, if one uses a geopolitical and organizational structure, 
which is the common model for DNs, we see lots of reasonable options 
for dividing the tree and determining who is responsible for 
maintainign what portions of it.  On the other hand, if a DN consists 
of an e-mail address plus givenname and surname, this seems rather 
odd.  The e-mail address, as a single attribute, results in a very 
broad fan out under the root. (in contrast, if one used DC 
attributes, as mentioned recently, one could mimic the structure of 
the DNS, which is well suited for separation and distributed 
maintenance, as the DNS has shown.)  Since e-mail addresses are 
already globally unique, what does the given name and surname do for 
you, from a tree structure standpoint?

Steve

---

From: Stephen Kent <[email-masked]>
Date: Thu, 22 Jun 2000 18:28:43 -0400

Bob,

>e-mail mailbox, and very often do.  And one person may have more than one

OK. But that does not justify constructing the schema we're debating, 
nor does the schema in question match your examples below.

>be multiple c=US, sP=MA, l=Cambridge, cN="Steve Kent".

Yes, we need to have a DN that distinguishes among multiple Steve 
Kents. In your example above, a postal address would typically be 
employed to identify me as a specific residential person, or a 
binding to my employer would be used for me as an organizational 
person.

>{c=US, sP=MA, l=Cambridge, cN="Steve Kent"}+rfc822="[email-masked]"

True.  If the intent were to create multiple leaf entries below the 
single entry of this form then  the justification would be better, 
but I don't that's what people have been suggesting.

>may in fact refer to the same individual.

No argument there.  Multiple entries in the DIT may correspond to the 
same physical entity, ad would usually be true for residential and 
organizational persons, for example.

>may also refer to the same person.

Sure.

Steve

---

From: "Bob Jueneman" <[email-masked]>
Date: Thu, 22 Jun 2000 17:11:18 -0600

Steve/Clark :-),

It's not that I particularly like compound attributes, but that's what
I was suggesting, rather than having the rfc822 be a leaf under the user name
DN.  That's what I mean to imply by the plus sign -- exactly like most
people have been suggesting for name+serial.  At least the rfc822 name
component has a great semantic content than a serial number.

On the other hand, I guess we could always revert to the imfamous MPEG 
of me and my cat. But instead of putting it in the DN, I guess we would have 
to make it a directory attribute now.  (Just joking, of course.)

Bob

>>> Stephen Kent <[email-masked]> 06/22/00 04:28PM >>>
Bob,

Sure.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Fri, 23 Jun 2000 15:58:35 -0400

Bob,

>Steve/Clark :-),

(hey, don't blow my cover ...)

>component has a great semantic content than a serial number.

Yes. But, what people were suggesting was a DN with ONLY a given name 
and surname, plus an e-mail address.  That's a bit odd from a 
directory structure perspective. Obviously we would not use the first 
two components as RDNs under a root, since there would be no good way 
to separate the database base for people on a large geographic basis 
using those attributes. If we used the e-mail address as the first 
RDN it would allow for meaningful partitioning, but because the 
address is a composite value, it seems wrong too.  It would be more 
appropriate to use the DC attribute to mimic the DNS structure, then 
put the user name as the leaf RDN.  In that case, though, the given 
name and surname are redundant, right?

Steve