Subject: RE: 2459 disapproved by MSFT and VeriSign?

From: Philip Hallam-Baker <[email-masked]>
Date: Thu, 21 Sep 2000 10:36:49 -0700

> Phil,
> 
> We obviously differ in our views of what constitutes the right way to 
> make tradeoffs wrt Internet standards.  My bias comes from serving on 
> the IAB for over a decade, and from having been involved in the 
> development of Internet protocols for over 20 years.  I'm comfortable 
> with that basis for making the tradeoff. Jon Postel's oft quoted 
> phrase is a good one, and I discussed the implications of it in 
> security contexts on many occasions.  We didn't always agree :-), but 
> Jon was certainly a big supporter of architectural purity.
> 
> Steve

I don't think we have such a wide disagreement. We are all agreed upon
what the architecture SHOULD look like. The question is simply one of
how we migrate towards that architecture.

Suggestions that VeriSign should ONLY issue certificates that don't 
work with X% or of the deployed base for the sake of 'architectural
purity' are plain silly if X is 50% and more reasonable if X is 0.05%.

My VeriSign Certificate has the email address encoded in SubjectAltName
and not in the DN. So we certainly have the ability to support 2459.
The 'problem' seems to be that we also support other profiles if
the customer selects them.

Today every ISP supports IPV4. That is not taken as a statement from
those ISPs that they do not intend to use IPV6. On the contrary, we
all know that eventually there will be a migration but before the
ISPs can move the customers need to be able to buy robust IPV6
platforms.

		Phill

---

From: Stephen Kent <[email-masked]>
Date: Fri, 22 Sep 2000 17:01:40 -0400

Phil,

>the customer selects them.

PKIX is not telling VeriSign what to do. VeriSign does what it deems 
appropriate, based on market requirements, or on perceived 
requirement created by astute marketing folks :-). (VeriSign is such 
a dominant force in the public PKI space that it has the ability to 
set customer expectations, which blurs the distinction.)  PKIX is 
just saying what constitutes the preferred way to represent certain 
ID forms, and what qualifies as conforming to its standards.

Anyway, the reality is that VS and other CAs put e-mail addresses 
into DNs when there were no other standard places to put them, and 
Netscape and MS, also eager to support such identifiers in their 
products (S/MIME in browsers) coordinated their products to make it 
all work.  That was understandable when there were no other choices, 
but we have moved on.  I think 2459 does a reasonable job of 
explaining the situation and stating why the preferred approach, 
going forward, is to make use of the designated alt subject name type 
to represent this information. if one did not take a strong position 
on this issue, where would be the motivation to change?

>ISPs can move the customers need to be able to buy robust IPV6

True, but IPv4 was and is still an IETF standard; the e-mail address 
representation convention we're debating was not adopted as a 
standard by the IETF and thus is not an ideal analogy.

Steve