Subject: Re: OCSP I-Ds going forward

From: Stephen Kent <[email-masked]>
Date: Mon, 2 Dec 2002 15:22:23 -0500

In this discussion I think many folks are operating under an 
assumption that is not part of the game when one worries about 
attacks.  Yes, X.509 assumes that DNs are unique, because X.500 
assumes that, and if all the players are good guys, they will play by 
the rules. In most cases, this will work. But, if we anticipate the 
possibility that some CA will become part of a PKI and that someone 
may try to deliberately confuse matters by constructing a 
(subordinate) CA with an intentionally duplicate name, then it 
behooves us to take precautions to mitigate the risks associated with 
this kind of behavior.

Steve