Subject: registration authorities

From: Carlos González-Cadenas <[email-masked]>
Date: Thu, 16 Dec 2004 11:45:40 +0100

Hi all,

In RFC 3739 (Qualified Certificates Profile), we do have a place to state
the name of the registration authorities that registered the names and
attributes present in the certificate.

Is there any standard way to do it in non-qualified certificates?

Thanks in advance

Carlos

Carlos González-Cadenas

Jefe de Departamento de Arquitectura Software

Software Architecture Department Manager

Responsable de Seguridad de la Información

Information Security Responsible

netfocus
by Siemens-BancSabadell

C/Sena, 12 nucli C planta 2
Edifici Landscape
08190 Sant Cugat del Vallès

phone:  +34933556139
fax:      +34933556142
mailto:  [email-masked]
web:     www.netfocus.es <http://www.netfocus.es/>

Advertencia legal:
Este mensaje y, en su caso, los ficheros anexos son confidenciales,
especialmente en lo que respecta a los datos personales, y se dirigen
exclusivamente al destinatario referenciado. Si usted no lo es y lo ha
recibido por error o tiene conocimiento del mismo por cualquier motivo, le
rogamos que nos lo comunique por este medio y proceda a destruirlo o borrarlo,
y que en todo caso se abstenga de utilizar, reproducir, alterar, archivar o
comunicar a terceros el presente mensaje y ficheros anexos, todo ello bajo pena
de incurrir en responsabilidades legales. El emisor no garantiza la integridad,
rapidez o seguridad del presente correo, ni se responsabiliza de posibles
perjuicios derivados de la captura, incorporaciones de virus o cualesquiera
otras manipulaciones efectuadas por terceros.

Advertiment legal:
Aquest missatge i, si escau, els fitxers annexos tenen caire confidencial,
especialment pel que fa a les dades personals, i s'adrecen exclusivament al
destinatari referenciat. Si no es tracta d'aquest i l'ha rebut per error o se li
ha fet arribar per qualsevol motiu, li preguem que ens ho comuniqui per aquesta
mateixa via i el destrueixi o l'esborri, i que en tot cas s'abstingui d'utilitzar,
reproduir, alterar, arxivar o comunicar a tercers aquest missatge i fitxers
annexos, tot sota pena d'entrar en responsabilitats legals. L'emissor no garanteix
la integritat, la rapidesa o la seguretat d'aquest correu, ni es responsabilitza
de possibles perjudicis derivats de la captura, incorporacions de virus o
qualssevol altres manipulacions que facin tercers.

Disclaimer:
This message and any attached files transmitted with it, is confidential,
especially as regards personal data. It is intended solely for the use of the
individual or entity to whom it is addressed. If you are not the intended recipient
and have received this information in error or have accessed it for any reason,
please notify us of this fact by email reply and then destroy or delete the message,
refraining from any reproduction, use, alteration, filing or communication to third
parties of this message and attached files on penalty of incurring legal
responsibilities. The sender does not guarantee the integrity, the accuracy, the
swift delivery or the security of this email transmission, and assumes no
responsibility for any possible damage incurred through data capture, virus
incorporation or any manipulation carried out by third parties.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 16 Dec 2004 06:53:52 -0500

At 11:45 AM +0100 12/16/04, Carlos González-Cadenas wrote:
>Hi all,
>
>In RFC 3739 (Qualified Certificates Profile), we 
>do have a place to state the name of the 
>registration authorities that registered the 
>names and attributes present in the certificate.
>

No, just the CA name.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Thu, 30 Dec 2004 09:53:57 -0500

At 2:24 PM +0000 12/30/04, David Chadwick wrote:
>Steve
>
>a CA is a Certification Authority, and not necessarily a 
>Registration Authority. Conceptually and operationally they are 
>different and therefore there should always be an allowance for this.
>
>regards
>
>David
>

David,

I certainly agree with the distinction, but other than in the context 
of qualified certs, X.509 does not make explicit provision for 
inclusion of RA info, probably since it is not used in the cert 
validation process.

Peter Sylvester noted shortly after my message, a CA is certainly 
free to out an RA name in a cert, bnut I assumed he meant that one 
could include the qc extension and put the RA name in it. In that 
case the cert looks like a QC cert, syntactically, hence my comment.

Steve

---

From: David Chadwick <[email-masked]>
Date: Thu, 30 Dec 2004 14:24:20 +0000

Steve

a CA is a Certification Authority, and not necessarily a Registration 
Authority. Conceptually and operationally they are different and 
therefore there should always be an allowance for this.

regards

David

Stephen Kent wrote:
>> In RFC 3739 (Qualified Certificates Profile), we do have a place to 
>> state the name of the registration authorities that registered the 
> *
> *
> *No, just the CA name.*
> *
> *
> *Steve*

-- 

*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 1484 532930
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Web site: http://sec.isi.salford.ac.uk
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************