Subject: On Subject Organization logotypes

From: "Jacoby, Jeffrey" <[email-masked]>
Date: Fri, 6 Dec 2002 11:22:26 -0800

All,

  I have a use scenario which I though might be 
fulfilled by the subject organization logotype.  
However, after reading the draft (<draft-ietf-
pkix-logotype-08.txt>), I'm not so sure anymore.  
Here is the relevant text, on page 10:

  Subject Organization Logotype. If subjectLogo 
  is present, the logotype MUST represent the subject's 
  organization. The logotype MUST be consistent with, 
  and require the presence of, an organization name 
  stored in the organization attribute in the subject 
  field (for either a public key certificate or 
  attribute certificate). The subjectLogo MAY be present 
  in an end entity certificate, a CA certificate, or 
  an attribute certificate.

The above text, particularly the requirement of a 
subject organization attribute, seems to preclude 
the easy use of the subject's portrait as a means 
of identifying and selecting certificates.

The scenario I'm thinking of is best illustrated by 
an example.  Suppose someone of reasonable public 
notoriety, say Tom Clancy, author of best-selling 
books, has a certificate.  

How can his certificate be identified as one belonging 
to Tom Clancy "the world famous author" vs. one belonging 
to Tom Clancy "ordinary guy in San Mateo, California"?   

Examination and verification of the issuer chain may or 
may not answer the question (perhaps both have perfectly
valid Thawte certificates).  Also, being of such notoriety 
he likely doesn't want to give out personal information 
that would positively distinguish him (or how would I even 
know if that was distinguishing information).

One of the few things that is fairly unique AND public is 
his face (and easy for an RA to verify) and would seem to 
be the thing to put in an extension like the logotype.  For 
this to work, however, the above text would seem to require 
him to be his own organization--I think.

How would a situation/scenario like this, or others similar 
to this one, be resolved?  Is this even a reasonable use case 
for logotypes?  

Thanks,

Jeff

---

From: Stephen Kent <[email-masked]>
Date: Fri, 6 Dec 2002 14:42:17 -0500

Jeff,

The logotype extension is NOT intended to identify individuals with 
photos as suggested in your scenario, which is why it does not allow 
for an extension associated with a subject EE.

If Tom wants to have a gif of himself in a cert, then he can be a CA 
for an organization (Tom Clancy Inc), and issue certs only to 
himself. This would probably accomplish the same underlying goal of 
recognition that is the focus of your scenario, right?

Steve

---

From: Russ Housley <[email-masked]>
Date: Fri, 06 Dec 2002 17:33:08 -0500

Jeff:

It seems like this would be a subject logo, not a subject organization logo.

Russ

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 09 Dec 2002 10:16:26 +0100

Russ,

> It seems like this would be a subject logo, not a subject organization 

Correct.

Now, to achieve the original goal of comparing pictures, we do have a 
solution with RFC 3039 (Qualified Certificates Profile). See section 3.2.4.

3.2.4  Biometric Information

    This section defines an extension for storage of biometric
    information.  Biometric information is stored in the form of a hash
    of a biometric template.

    The purpose of this extension is to provide means for authentication
    of biometric information.  The biometric information that corresponds
    to the stored hash is not stored in this extension, but the extension
    MAY include an URI pointing to a location where this information can
    be obtained.  If included, this URI does not imply that this is the
    only way to access this information.

    It is RECOMMENDED that biometric information in this extension is
    limited to information types suitable for human verification, i.e.,
    where the decision of whether the information is an accurate
    representation of the subject is naturally performed by a person.
    This implies a usage where the biometric information is represented
    by, for example, a graphical image displayed to the relying party,
    which MAY be used by the relying party to enhance identification of
    the subject.

Denis