Subject: [pkix] Unclear public-key certificate definition in X.509

From: "Erik Andersen" <[email-masked]>
Date: Wed, 3 Nov 2010 17:25:26 +0100

I have proposed some modification to a paragraph in X.509 as documented by
the attached file.

I wonder whether you PKIX guys have comments on this proposal. Any comment
will be appreciated.

Erik Andersen

Andersen's L-Service

Elsevej 48,

DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

e-amail: [email-masked]

Skype: andersen-erik

http://www.x500.eu/

http://www.x500standard.com/

 <http://dk.linkedin.com/in/andersenerik>
http://dk.linkedin.com/in/andersenerik

---

From: Tom Gindin <[email-masked]>
Date: Tue, 9 Nov 2010 08:24:41 -0500

Since A denotes the user's distinguished name, it confuses me (and 
probably others as well) to describe the CA as having name CA(A) and UID 
UCA(A).  Would this not be easier to understand if the CA had name CA(B) 
and ID UCA(B), or if subscripts were used?  After all, the CA is a 
different entity than the user, and your expression has A being used in 
both contexts.

Tom Gindin

From:
"Erik Andersen" <[email-masked]>
To:
"PKIX" <[email-masked]>
Date:
11/03/2010 12:28 PM
Subject:
[pkix] Unclear public-key certificate definition in X.509
Sent by:
[email-masked]

 
Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/
http://www.x500standard.com/
http://dk.linkedin.com/in/andersenerik
 [attachment "DR-xx.pdf" deleted by Tom Gindin/Watson/IBM] 
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: "Erik Andersen" <[email-masked]>
Date: Fri, 12 Nov 2010 09:57:38 +0100

Hi Tom,

Thanks for comments. I share your concern. I have updated the suggested
text. Please check.

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: Tom Gindin [mailto:[email-masked]] 
Sendt: 9. november 2010 14:25
Til: Erik Andersen
Cc: PKIX
Emne: Re: [pkix] Unclear public-key certificate definition in X.509

Tom Gindin

From:

 
Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

---

From: Tom Gindin <[email-masked]>
Date: Fri, 12 Nov 2010 19:38:13 -0500

It no longer has the problem which it had before.  Of course, it's 
a little odd to describe a certificate as a function of specifically the 
DN of the issuer, since the critical functional dependency is on the 
issuer's key pair.    My own wording would go: produced by a certification 
authority with the distinguished name CA1, unique identifier UCA1, and key 
pair KCA1, has the following form: Cert<<A, CA1>> = KCA1 { your args }. 
The CA(A) expression just confuses me, because it suggests that the CA is 
a function of the subject name.

Tom Gindin

From:
"Erik Andersen" <[email-masked]>
To:
Tom Gindin/Watson/IBM@IBMUS
Cc:
"'PKIX'" <[email-masked]>
Date:
11/12/2010 03:58 AM
Subject:
SV: [pkix] Unclear public-key certificate definition in X.509

Hi Tom,

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: Tom Gindin [mailto:[email-masked]] 
Sendt: 9. november 2010 14:25
Til: Erik Andersen
Cc: PKIX
Emne: Re: [pkix] Unclear public-key certificate definition in X.509

Tom Gindin

From:

the attached file.

will be appreciated.
 
Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

[attachment "X509-pot-01.pdf" deleted by Tom Gindin/Watson/IBM]