Subject: [pkix] Private information extension on X.509 certificate

From: koichi sugimoto <[email-masked]>
Date: Tue, 2 Aug 2011 19:41:16 +0900

Dear Sirs,

I've been considering about some security problems among internet in
relation to X.509 certificate.

1) If client certificate has some personal private information (e.g.
name, address, national ID etc.),
the certificate leaks the personal information to the internet. But
some situations force us to disclose
the information with certification.

2) Many spam mails are sent to publicly opened email address. If our
s/mime certificate are opened to
internet, the number of the spam mails may inclease extremely. - This
was alredy argued in this community.

3) Many information leakage incidents were occueered by hacking the web sites.
Leackage of personal information, credit card number is the most
critical damage for the site owner.

If these kind of informations are protected by encryption or access
control, what will be happened?

Suppose that these infomations are embeded as certificate extensions.
For example:

A) Fully certified and encrypted infomation
This information is sent to CA and encrypted by end-entity's public key
The hashed value of the encypted data and the pointer (URI or
something) are put in the certificate.
 - name, national ID, address, e-mail address, pictures etc.. are
categolized to
   this group.

B) Personally encrypted information
This information is encrypted by end-entity or something, and only
hashed value of the encrypted data
and the pointer are put in the certificate. This information is not
certified by CA.
 - credit card number etc. are categolized to this group.

C) Access controlled information
This infomation is access-controlled by some site.
Only the URI is put in the certificate.
 - profile, pictures etc. are categolized to this group. This kind of
data is shared to some closed group.

Sorry for my poor english.

Regards,
Koichi Sugimoto.