Subject: Re: 2459 disapproved by MSFT and VeriSign?

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 25 Sep 2000 12:32:49 +0200

Steve,

<snip>

>Anyway, the reality is that VS and other CAs put e-mail addresses into DNs when there were no other standard places to put them, and >Netscape and MS, also eager to support such identifiers in their products (S/MIME in browsers) coordinated their products to make it all >work. That was understandable when there were no other choices, but we have moved on. I think 2459 does a reasonable job of explaining >the situation and stating why the preferred approach, going forward, is to make use of the designated alt subject name type to represent this >information. if one did not take a strong position on this issue, where would be the motivation to change?

I.e. you think it is reasonable to insist on changing an existing already widely used scheme for reasons that are not that obvious for
most users (including some PKI-professionals as well)?

Steve, now this deviation between a (rather late) standard-2-be and its likely implementation is very close to be happening
once again (right in front of thousands of PKIX-list users):

The s.c. "Permanent Identifiers" that is in draft format is IMO a real candidate for similar deficiencies and ambiguities due
to this rather rigid view of what a DN is and must be.  How come?

1.  Permanent Identifiers have been in active use for quite some time (5y+).  There are even commercially available products from
TTPs like VeriSign/eccellerate (organization certificates with DUNS numbers) and from the Swedish Post Office (ID-certificates
with citizen registration numbers).  And AFAIK these products use the subject DN as the place to put the PI info
(The use of Subject Alt Name except *maybe* for e-mail is still considered "exotic" and its value is not fully understood).

2. The PI-draft will give a new "home" for these permanent identifiers.  Problem solved? Well, not really.
Due to the already existing use of PIs in DNs, and an increasing use of mapping software, the "old" scheme will (MUST)
continue to live FOREVER.  I.e. the new "standardized" PI home will contain duplicate (=REDUNDANT) information.

Solution: IMO The PI-draft should have specified a non-critical extension that points out what components of
a DN that constitutes the PI.  I.e. a DN "filter" formula that the RP may understand or not.  Such that a CA can
introduce it at any time without breaking any code or changing existing (by a minority perceived as bad) habits. 

Anders

---

From: Stephen Kent <[email-masked]>
Date: Wed, 27 Sep 2000 11:01:57 -0400

Anders,

>Steve,
>
><snip>
>
>  >Anyway, the reality is that VS and other CAs put e-mail addresses 
>into DNs when there were no other standard places to put them, 
>and >Netscape and MS, also eager to support such identifiers in 
>their products (S/MIME in browsers) coordinated their products to 
>make it all >work. That was understandable when there were no other 
>choices, but we have moved on. I think 2459 does a reasonable job of 
>explaining >the situation and stating why the preferred approach, 
>going forward, is to make use of the designated alt subject name 
>type to represent this >information. if one did not take a strong 
>position on this issue, where would be the motivation to change?
>
>I.e. you think it is reasonable to insist on changing an existing 
>already widely used scheme for reasons that are not that obvious for

It is not the goal of the WG to endorse implementation decisions 
that, though understandable at the time, were not even consistent 
with the original base standard (X.509), and which are not consistent 
with current X.509 (v3) standards.

>Steve, now this deviation between a (rather late) standard-2-be and 
>its likely implementation is very close to be happening
>The s.c. "Permanent Identifiers" that is in draft format is IMO a 
>real candidate for similar deficiencies and ambiguities due
>1.  Permanent Identifiers have been in active use for quite some 
>time (5y+).  There are even commercially available products from
>TTPs like VeriSign/eccellerate (organization certificates with DUNS 
>numbers) and from the Swedish Post Office (ID-certificates
>with citizen registration numbers).  And AFAIK these products use 
>the subject DN as the place to put the PI info
>(The use of Subject Alt Name except *maybe* for e-mail is still 
>considered "exotic" and its value is not fully understood).

We have a fundamental disagreement about the purpose of this WG, 
which I alluded to above. I don't think I can make it any clearer.

>2. The PI-draft will give a new "home" for these permanent 
>identifiers.  Problem solved? Well, not really.
>Due to the already existing use of PIs in DNs, and an increasing use 
>of mapping software, the "old" scheme will (MUST)
>continue to live FOREVER.  I.e. the new "standardized" PI home will 
>contain duplicate (=REDUNDANT) information.
>
>Solution: IMO The PI-draft should have specified a non-critical 
>extension that points out what components of
>a DN that constitutes the PI.  I.e. a DN "filter" formula that the 
>RP may understand or not.  Such that a CA can
>introduce it at any time without breaking any code or changing 
>existing (by a minority perceived as bad) habits.

Thanks for your opinion.  I'll leave it to Denis to address details 
of your comments during last call.

Steve