Subject: I-D ACTION:draft-ietf-pkix-pi-07.txt

From: [email-masked]
Date: Tue, 29 Jul 2003 12:15:10 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

	Title		: Internet X.509 Public Key Infrastructure Permanent 
                          Identifier
	Author(s)	: D. Pinkas, T. Gindin
	Filename	: draft-ietf-pkix-pi-07.txt
	Pages		: 15
	Date		: 2003-7-29
	
This document define a new form of name, called permanent 
identifier, that may be included in the subjectAltName extension 
of a public key certificate issued to an entity.
The permanent identifier is an optional feature that may be used 
by a CA to indicate that the certificate relates to the same 
entity even if the name or the affiliation of that entity stored 
in the subject or another name form in the subjectAltName extension 
has changed.
The subject name, carried in the subject field, is only unique 
for each subject entity certified by the one CA as defined by the 
issuer name field. Also, the new name form can carry a 
name that is unique for each subject entity certified by a CA.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-pi-07.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-pkix-pi-07.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-pkix-pi-07.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 30 Jul 2003 09:47:47 +0200

The IESG has been discussing the draft-ietf-pkix-pi document, and mentioned 
that some information was needed to bring the discussion to closure.

The document allows the naming authority to be identified in several 
different ways. The following chunk of ASN.1 from the document illustrates 
the point:

      PermanentIdentifier ::=     SEQUENCE {
         identifierValue              IdentifierValue,
         identifierType               IdentifierType OPTIONAL,
         matchingRule        [0]      IMPLICIT OBJECT IDENTIFIER OPTIONAL
      }

      IdentifierValue ::= CHOICE {
             iA5String            IA5String,
             uTF8String           UTF8String
      }

      IdentifierType ::= CHOICE {
             registeredOID                   OBJECT IDENTIFIER,
             uri                             IA5String
      }

The pros and cons of OIDs and URIs have been discussed in the IESG.
In practice, they are not used in the same manner.

Some people are uncomfortable with OIDs. For one thing, there is no 
straightforward way of getting to know anything more about them than the 
values of their numbers, which give no hint of the context in which they 
were assigned.

Some people are uncomfortable with URIs. Their content is subject to various 
interpretations, and people sometimes make unreasonable guesses based on the 
strings embedded in the URI.

Russ, our security area Director, indicated to the PKIX mailing list that
an update to the Internet-Draft was needed to resolve the DISCUSS votes.

After discussions between the co-editors and some other people, we came to 
the conclusion that no change was needed to the core document, but that an 
informative annex was necessary to deal with the topic of permanent URIs.

The document draft-ietf-pkix-pi-07.txt is an update where an annex C has 
been added in order to address the concern.

Denis

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 30 Jul 2003 17:45:41 -0700

Denis,

I have just gone through this document and I have some comments that I
believe MUST be resolved before the IESG can accept this document.
These comments deal with the ASN.1 modules at the end of the document.

1.  The module identifer OID used in the 1988 syntax has already been
assigned to the OCSP module.
2.  You are missing a semi-colon at the end of the imports section
3.  You are importing from RFC 2459 not from RFC 3280
3.  AttributeType is imported but not referenced.
4.  UTF8String is not defined anywhere.
5.  There should be text specifing that the 1988 module is normative and
the 1993 module is informative.
6.  Similar errors exist in the 1993 module, but I don't have a compiler
for it so I don't have a complete list.

jim

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Denis Pinkas
> Sent: Wednesday, July 30, 2003 12:48 AM
> To: [email-masked]; Russ Housley; Steve Bellovin
> Subject: Re: I-D ACTION:draft-ietf-pkix-pi-07.txt
> 
> 
> 
> The pros and cons of OIDs and URIs have been discussed in the 
> IESG. In practice, they are not used in the same manner.
> 
> Russ, our security area Director, indicated to the PKIX 
> mailing list that an update to the Internet-Draft was needed 
> to resolve the DISCUSS votes.
>