Subject: RE: 2459 disapproved by MSFT and VeriSign?

From: Philip Hallam-Baker <[email-masked]>
Date: Wed, 20 Sep 2000 11:29:51 -0700

I find this discussion somewhat strange. The long standing principle of
the IETF has been to make systems as interoperable as possible. In
particular the IETF has always frowned on architectural transitions that
cause deployed products to break unnecessarily.

Architectural purity has ALWAYS come second.

There are good reasons to ensure that all applications are capable of
ACCEPTING email addresses encoded in SubjectAltName. Not least the fact
that people in organizations tend to have multiple email addresses.

'Be permissive in what you accept, be caution in what you generate'

It is no problem for a CA to generate email addresses in any particular
certificate slot - especially if the CA does not care about strict
compliance with the X.509 standard.

Customers on the other hand might have problems using those certificates
with legacy applications. A substantial part of the value added by an
outsource service is to be able to help the customer make informed
decisions about the configuration of their certificate.

		Phill

Phillip Hallam-Baker
Principal Scientist
VeriSign Inc.
[email-masked]
781 245 6996 x227

---

From: Stephen Kent <[email-masked]>
Date: Wed, 20 Sep 2000 16:10:50 -0400

Phil,

We obviously differ in our views of what constitutes the right way to 
make tradeoffs wrt Internet standards.  My bias comes from serving on 
the IAB for over a decade, and from having been involved in the 
development of Internet protocols for over 20 years.  I'm comfortable 
with that basis for making the tradeoff. Jon Postel's oft quoted 
phrase is a good one, and I discussed the implications of it in 
security contexts on many occasions.  We didn't always agree :-), but 
Jon was certainly a big supporter of architectural purity.

Steve