Subject: Re: [pkix] [Spam] [x500standard] SV: Re: VS: Unclear public-key certificate definition in X.509

From: "Erik Andersen" <[email-masked]>
Date: Fri, 12 Nov 2010 16:53:41 +0100

Denis responded to the Directory list. Here is my response. Any comment?

Erik Andersen

Andersen's L-Service

Elsevej 48,

DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

e-amail: [email-masked]

Skype: andersen-erik

 <http://www.x500.eu/> http://www.x500.eu/

 <http://www.x500standard.com/> http://www.x500standard.com/

 <http://dk.linkedin.com/in/andersenerik>
http://dk.linkedin.com/in/andersenerik

Fra: [email-masked]
[mailto:[email-masked]] På vegne af Erik Andersen
Sendt: 12. november 2010 16:49
Til: [email-masked]
Emne: [Spam] [x500standard] SV: Re: VS: [pkix] Unclear public-key
certificate definition in X.509

Hi Denis,

Thanks for your comments.

The original text has been there almost since the Big Bang. I just tried to
make it a little more correct.

Like you, I do not like the text. Following this text is the ASN.1 for the
certificate with what should be a detailed certificate specification. I do
not believe the paragraph adds anything. I believe it a waste of the
reader’s time trying to understand it. I actually now propose to replace the
complete paragraph with:

A CA produces the public-key certificate of a user by signing (see 6.1) a
collection of information as specified by the Certificate data type below.

I also agree that issuerUniqueIdentifier and subjectUniqueIdentifier should
be deprecated, as they are in RFC 5280. I could not find any references to
them in the CA Browser Forum specification. What about ETSI?

Erik Andersen

Andersen's L-Service

Elsevej 48,

DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

e-amail: [email-masked]

Skype: andersen-erik

http://www.x500.eu/

http://www.x500standard.com/

 <http://dk.linkedin.com/in/andersenerik>
http://dk.linkedin.com/in/andersenerik

Fra: [email-masked]
[mailto:[email-masked]] På vegne af Denis Pinkas
Sendt: 12. november 2010 14:40
Til: x500 list
Emne: [x500standard] Re: VS: [pkix] Unclear public-key certificate
definition in X.509

I don't like this text which places too much emphasis on the Unique
Identifier 
which is deprecated by the PKIX WG and which is not used in practice:

"A CA produces the public-key certificate of a user by signing (see 6.1) a
collection of information, 
including the user's distinguished name and public key, as well as an
optional unique identifier 
containing additional information about the user". 

The text is also misleading: the public key of the user is not signed. It is
both the algorithm identifier 
and the public key which are signed.

The key point is also that the mandatory validity period is lost.

So I would propose:

"A CA issues a public-key certificate for a user by signing (see 6.1) a
collection of information, 
including its distinguished name, the user's distinguished name, a validity
period, an identifier 
of a public algorithm and the value of a public key for the user, as well as
optional additional 
information like for the permitted usage of the user's public key".

Then the text states: "Ap is the public key of the user". This is incorrect.
It is both the algorithm identifier 
and the public key of the user. Why Ap ? What does it mean ?

Denis

---------- 

>From : x500standard-bounce 

To : Directory list 

Date : 2010-11-12, 09:59:49

Subject : [x500standard] VS: [pkix] Unclear public-key certificate
definition in X.509

Folks on this list are also welcome to comment.

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked] <mailto:[email-masked]> 
Skype: andersen-erik
http://www.x500.eu/
http://www.x500standard.com/
http://dk.linkedin.com/in/andersenerik

-----Oprindelig meddelelse-----
Fra: Erik Andersen [mailto:[email-masked] <mailto:[email-masked]> ] 
Sendt: 12. november 2010 09:58
Til: 'Tom Gindin'
Cc: 'PKIX'
Emne: SV: [pkix] Unclear public-key certificate definition in X.509

Hi Tom,

Thanks for comments. I share your concern. I have updated the suggested
text. Please check.

Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked] <mailto:[email-masked]> 
Skype: andersen-erik
http://www.x500.eu/
http://www.x500standard.com/
http://dk.linkedin.com/in/andersenerik

-----Oprindelig meddelelse-----
Fra: Tom Gindin [mailto:[email-masked] <mailto:[email-masked]> ]
Sendt: 9. november 2010 14:25
Til: Erik Andersen
Cc: PKIX
Emne: Re: [pkix] Unclear public-key certificate definition in X.509

        Since A denotes the user's distinguished name, it confuses me (and
probably others as well) to describe the CA as having name CA(A) and UID
UCA(A). Would this not be easier to understand if the CA had name CA(B) and
ID UCA(B), or if subscripts were used? After all, the CA is a different
entity than the user, and your expression has A being used in both contexts.

Tom Gindin

From:
"Erik Andersen" <[email-masked] <mailto:[email-masked]> >
To:
"PKIX" <[email-masked] <mailto:[email-masked]> >
Date:
11/03/2010 12:28 PM
Subject:
[pkix] Unclear public-key certificate definition in X.509 Sent by:
[email-masked] <mailto:[email-masked]> 

I have proposed some modification to a paragraph in X.509 as documented by
the attached file.
 
I wonder whether you PKIX guys have comments on this proposal. Any comment
will be appreciated.
 
Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked] <mailto:[email-masked]> 
Skype: andersen-erik
http://www.x500.eu/
http://www.x500standard.com/
http://dk.linkedin.com/in/andersenerik
 [attachment "DR-xx.pdf" deleted by Tom Gindin/Watson/IBM]
_______________________________________________
pkix mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/pkix

---

From: Peter Sylvester <[email-masked]>
Date: Fri, 12 Nov 2010 17:19:43 +0100

Although I somewhat disagree with Denis that a public key is just a value,
IMO it is the identifier+ an interpretable value, anyway, it may be useful
to say that "Ap is the entity's  public key (composed of an
algorithm identifier and a value)"
In Denis' proposal  'public algorithm' is dissociated from the key value,
(and probably there is a missing "key" in the middle)

I agree with the remarks about UID.

optional parameters/additional  ok, remove 'for the permitted usage'
or change permitted by intended or

"optional parameters for the intended usage or
for different types of identification"

you may not have a real DN at all.

Needless to say that some native English with a good understanding
of typical problems in continental english might want to say something.

On 11/12/2010 04:53 PM, Erik Andersen wrote:
> *Fra:[email-masked] [mailto:[email-masked]] *På vegne af 
> *Erik Andersen
> *Sendt:* 12. november 2010 16:49
> *Til:* [email-masked]
> *Emne:* [Spam] [x500standard] SV: Re: VS: [pkix] Unclear public-key certificate definition in X.509
>
> Hi Denis,
>
> The original text has been there almost since the Big Bang. I just tried to make it a little more 
> correct.
>
> Like you, I do not like the text. Following this text is the ASN.1 for the certificate with what 
> should be a detailed certificate specification. I do not believe the paragraph adds anything. I 
> believe it a waste of the reader's time trying to understand it. I actually now propose to replace 
> the complete paragraph with:
>
> A CA produces the public-key certificate of a user by signing (see 6.1) a collection of 
> information as specified by the *Certificate* data type below.
>
> I also agree that issuerUniqueIdentifier and subjectUniqueIdentifier should be deprecated, as they 
> are in RFC 5280. I could not find any references to them in the CA Browser Forum specification. 
> What about ETSI?
>
> Erik Andersen
>
> Andersen's L-Service
>
> Elsevej 48,
>
> DK-3500 Vaerloese
>
> Denmark
>
> Mobile: +45 2097 1490
>
> e-amail: [email-masked]
>
> Skype: andersen-erik
>
> http://www.x500.eu/
>
> *Fra:[email-masked] [mailto:[email-masked]] *På vegne af 
> *Denis Pinkas
> *Sendt:* 12. november 2010 14:40
> *Til:* x500 list
> *Emne:* [x500standard] Re: VS: [pkix] Unclear public-key certificate definition in X.509
>
> I don't like this text which places too much emphasis on the Unique Identifier
> "A CA produces the public-key certificate of a user by signing (see 6.1) a collection of information,
> including the user's distinguished name and public key, as well as an optional /unique identifier
> /containing additional information about the user".
>
> The text is also misleading: the public key of the user is not signed. It is both the algorithm 
> identifier
> "A CA issues a public-key certificate for a user by signing (see 6.1) a collection of information,
> including its distinguished name, the user's distinguished name, a validity period, an identifier
> of a public algorithm and the value of a public key for the user, as well as optional additional
> Then the text states: "Ap is the public key of the user". This is incorrect.  It is both the 
> algorithm identifier
>     *From :*x500standard-bounce <mailto%20:[email-masked]>
>
>     *To :*Directory list <mailto%20:[email-masked]>
>
>     *Date :*2010-11-12, 09:59:49
>
>     *Subject :*[x500standard] VS: [pkix] Unclear public-key certificate definition in X.509
>
>     Fra: Erik Andersen [mailto:[email-masked] <mailto:[email-masked]>]
>     Fra: Tom Gindin [mailto:[email-masked] <mailto:[email-masked]>]
>     "Erik Andersen" <[email-masked] <mailto:[email-masked]>>
>     To:
>     "PKIX" <[email-masked] <mailto:[email-masked]>>
>     Date:
>     11/03/2010 12:28 PM
>     Subject:
> [email-masked]