Subject: Re: Name collisions

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 21 Jun 2005 10:48:11 +0100

David,

>> David,

>>>Oh dear. The same old problem of namespaces again. X.500 makes it very 
>>>clear that there is only one namespace for all Distinguished names, so 
>>>CAs cannot invent their own DNs in isolation to the rest of the world. 

>> You make the same mistake as many (but not all) in the OSI Directory WG 
>> by still confusing X.500 and X.509.

>Denis

>I think not. X.509 references X.501, which defines distinguished names. 
>So I dont think it was me who was confused, but rather a large number of 
>PKI people who read X.509 but never bothered to read X.501 (or even the 
>bits of X.501 that were referenced by X.509).

>David Cooper's message of 20 June tells you were the reference is made.

I have responded to it.
 
>> You cannot not mandate every CA on the earth to know all the other CAs  
>> (not yet CAs on the moon, as far as I know).

>We dont need to. We never have needed to. Do you know all the email 
>addresses in the world?? No, and you dont need to.

The big difference if that e-mail addresses are based on DNS, where name spaces 
are allocated based on rules. 

>All  you need to know is that your name/CA name/email address 
>etc....(add your other favourite global name here) is bound to be 
>different from all other ones. That is sufficient.

CAs do not need to have e-mail addresses.
 
>>>If they do, then their domain is the entire universe of distinguished 
>>>names and they cannot expect to interwork with any other CA without 
>>>experiencing name collisions.

>> It is perfectly possible to securely internetwork with other CAs, whether or not 
>> there are name collisions.   

>No I dont believe it is (always). If 2 CAs have the same name, and 
>re-key, or use indirect CRL issuers (which might also have name clashes) 
>then we have a hard problem on our hands in practice.

Stefan told the solution to this problem. Please take a close look again at 
Stefan's message since I believe that you read it too fast.  I have posted yesterday 
an I-D to explain in full details the whole story. I hope it will be published "soon".
 
>> It is not possible to build a secure system 

>Its not possible to build a 100% secure system anyway, ever.

While you are right in the general case, it is possible to set rules that make 
the system 100 % secure, of course unless some people crack the algorithms 
or do not follow some of the procedural rules.

>> making the (false) assumption 
>> that name collisions will never happen. Otherwise wrongdoers will penetrate 
>> systems constructed on that false assumption.

>Wrongdoers will penetrate all systems given enough time and money. So 
>this is not an argument against using globally unambiguous names.

CAs can use whatever names they feel appropriate *in their own DIT*.
A global universal DIT does not exist and will never exist 
(this was the original "dream" of X.500 many years ago).

Denis

>regards

>David