Subject: UIDs popping up in new-part1

From: Steve Hanna <[email-masked]>
Date: Wed, 28 Feb 2001 17:25:17 -0500

Last fall, we agreed to remove issuer and subject unique identifier
comparison from the validation algorithm. At least, I think we did. The
argument was that nobody uses unique identifiers and there's no good
reason to retain support for them.

In draft-ietf-pkix-new-part1-04.txt, this has almost been done. However,
they remain in step (a) (5) of section 6.1.3, which says:

         (5) The certificate issuer unique identifier is the
         working_issuer_UID, meaning:

            (i) working_issuer_UID is non-null and matches the value in
            the issuerUID field, or

            (ii) working_issuer_UID is null and the issuerUID field is
            not present.

But working_issuer_UID is no longer set anywhere. We should either put
back the text that initializes and updates this state variable or we
should change this step so that it doesn't refer to this uninitialized
varible. I suggest that we remove support for unique identifier chaining
by changing this step to say:

         (5) The issuerUniqueID and subjectUniqueID fields are not
         present in the certificate.

This will ensure that compliant implementations will not accidentally
accept certificates that use these fields, since support for these
fields is no longer required. I also suggest that we change the sentence
in section 4.1.2.8 that reads "Applications conforming to this profile
SHOULD be capable of parsing unique identifiers and making
comparisons."  to read "Applications conforming to this profile SHOULD
reject certificates that contain unique identifiers."

-Steve