Subject: draft-ietf-pkix-pi

From: Russ Housley <[email-masked]>
Date: Fri, 25 Apr 2003 09:37:32 -0400

Dear PKIX WG:

The IESG has been discussing the draft-ietf-pkix-pi document, and I need 
some information to bring the discussion to closure.

The document allows the naming authority to be identified in several 
different ways.  The following chunk of ASN.1 from the document illustrates 
the point:

      PermanentIdentifier ::=     SEQUENCE {
         identifierValue              IdentifierValue,
         identifierType               IdentifierType OPTIONAL,
         matchingRule        [0]      IMPLICIT OBJECT IDENTIFIER OPTIONAL
      }

      IdentifierValue ::= CHOICE {
             iA5String            IA5String,
             uTF8String           UTF8String
      }

      IdentifierType ::= CHOICE {
             registeredOID                   OBJECT IDENTIFIER,
             uri                             IA5String
      }

The pros and cons of OIDs and URIs have been discussed in the IESG.  In 
practice, they are not used in the same manner.

Some people are uncomfortable with OIDs. For one thing, there is no 
straightforward way of getting to know anything more about them than the 
values of their numbers, which give no hint of the context in which they 
were assigned.

Some people are uncomfortable with URIs. Their content is subject to 
various interpretations, and people sometimes make unreasonable guesses 
based on the strings embedded in the URI.

Is there a community that wants each naming alternative?

Russ

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 25 Apr 2003 21:57:06 +0200

Russ,

I think the crux is really that the draft talks about a 
"type of permanent identifier" but does not explain what
that means.

My interpretation:

   IdentifierType denotes a globally distinct name space 
   where the corresponding IdentifierValue has a meaning.
   In addition, IdentifierType can in certain issuances be
   associated with a specific type of end-entity like
   "citizen",  "employee", "device", "account", etc.

Computer software looking for a type (=name space) would usually
only treat URIs and OIDs as strings or blobs without any interpretation,
which IMHO means that they are (in this respect) to be considered as
"functionally equivalent".  This is further proved by the fact that an
OID can be recasted into a URI: http://www.ietf.org/rfc/rfc3061.txt.

But if I were to select, I would go for URIs alone, as:
1. URIs are more or less human-readable
2. URIs based on HTTP or HTTPS are potentially browsable (bonus)
3. Most organizations already own one or more domain names, 
    while only a fraction have an OID arc
4. Namespaces as featured in XML only use URIs

OIDs seem well suited for "internal" types like identifying
certificate extensions.  Names however, are typically
rather "visible" and "external" properties.

Anders

----- Original Message ----- 
From: "Russ Housley" <[email-masked]>
To: <[email-masked]>
Sent: Friday, April 25, 2003 15:37
Subject: draft-ietf-pkix-pi

Dear PKIX WG:

Russ

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 25 Apr 2003 17:46:17 -0700

>    uri                   IA5String }

Russ,

Please clarify.  Is the IESG saying the WG MUST eliminate the
CHOICE and so select a single type?

Mike