Subject: Re: [pkix] Unclear public-key certificate definition in X.509

From: Stefan Santesson <[email-masked]>
Date: Mon, 09 Jan 2012 06:44:11 +0100

Eric,

I think you can solve the confusion with something more close to the
original and stay compliant with table 1 by choosing the term "NCA" for
the name of the CA. It would be more compatible to the chosen term "UCA"
for the unique identifier of the CA.

Using CA1 and CA(A) is just adding confusion and is not necessary to
provide the point of the text.

I would suggest:

Original text:

 Specifically, the certificate of a user with distinguished name A and
unique identifier UA, produced by the certification authority with name CA
and unique identifier UCA, has the following form:

CA<<A>> = CA{V,SN,AI,CA,UCA,A,UA,Ap,TA}

New text:

 Specifically, the public-key certificate of a user with distinguished
name A and unique identifier UA, produced by the CA with name NCA and and
unique identifier UCA, has the following form:

CA<<A>> = CA{V,SN,AI,NCA,A,Ap,UCA,UA,TA,Ex}

/Stefan

On 10-12-13 11:13 AM, "Erik Andersen" <[email-masked]> wrote:

>Hi Tom,
>
>Any suggestion? If you have some ideas, how will affect Table 1 of X.509.
>The term CA(X) was introduced already in the first edition (1988). It is
>nothing of my doing.
>
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: [email-masked]
>Skype: andersen-erik
>http://www.x500.eu/
>http://www.x500standard.com/
>http://dk.linkedin.com/in/andersenerik
>
>-----Oprindelig meddelelse-----
>Fra: Tom Gindin [mailto:[email-masked]]
>Sendt: 11. december 2010 00:16
>Til: Erik Andersen
>Cc: Jean-Paul Lemaire; 'PKIX'
>Emne: Re: SV: SV: [pkix] Unclear public-key certificate definition in
>X.509
>
>        Please use a different parameter name than A here.  The bracket
>style is not the reason for the confusion.
>
>                Tom Gindin
>
>
>
>
>
>From:
>"Erik Andersen" <[email-masked]>
>To:
>Tom Gindin/Watson/IBM@IBMUS
>Cc:
>"'PKIX'" <[email-masked]>, "Jean-Paul Lemaire"
><[email-masked]>
>Date:
>12/08/2010 10:12 AM
>Subject:
>SV: SV: [pkix] Unclear public-key certificate definition in X.509
>
>
>
>Hi Tom and others,
>
>I am finally back on this one. I agree with your last statement. What do
>you
>think about writing CA[A] instead of CA(A)?
>
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: [email-masked]
>Skype: andersen-erik
>http://www.x500.eu/
>http://www.x500standard.com/
>http://dk.linkedin.com/in/andersenerik
>
>-----Oprindelig meddelelse-----
>Fra: Tom Gindin [mailto:[email-masked]]
>Sendt: 13. november 2010 01:38
>Til: Erik Andersen
>Cc: 'PKIX'
>Emne: Re: SV: [pkix] Unclear public-key certificate definition in X.509
>
>        It no longer has the problem which it had before.  Of course,
>it's 
>
>a little odd to describe a certificate as a function of specifically the
>DN of the issuer, since the critical functional dependency is on the
>issuer's key pair.    My own wording would go: produced by a
>certification 
>
>authority with the distinguished name CA1, unique identifier UCA1, and
>key 
>
>pair KCA1, has the following form: Cert<<A, CA1>> = KCA1 { your args }.
>The CA(A) expression just confuses me, because it suggests that the CA is
>a function of the subject name.
>
>Tom Gindin
>
>
>
>
>
>From:
>"Erik Andersen" <[email-masked]>
>To:
>Tom Gindin/Watson/IBM@IBMUS
>Cc:
>"'PKIX'" <[email-masked]>
>Date:
>11/12/2010 03:58 AM
>Subject:
>SV: [pkix] Unclear public-key certificate definition in X.509
>
>
>
>Hi Tom,
>
>Thanks for comments. I share your concern. I have updated the suggested
>text. Please check.
>
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: [email-masked]
>Skype: andersen-erik
>http://www.x500.eu/
>http://www.x500standard.com/
>http://dk.linkedin.com/in/andersenerik
>
>
>-----Oprindelig meddelelse-----
>Fra: Tom Gindin [mailto:[email-masked]]
>Sendt: 9. november 2010 14:25
>Til: Erik Andersen
>Cc: PKIX
>Emne: Re: [pkix] Unclear public-key certificate definition in X.509
>
>        Since A denotes the user's distinguished name, it confuses me
>(and 
>
>
>probably others as well) to describe the CA as having name CA(A) and UID
>UCA(A).  Would this not be easier to understand if the CA had name CA(B)
>and ID UCA(B), or if subscripts were used?  After all, the CA is a
>different entity than the user, and your expression has A being used in
>both contexts.
>
>Tom Gindin
>
>
>
>
>
>From:
>"Erik Andersen" <[email-masked]>
>To:
>"PKIX" <[email-masked]>
>Date:
>11/03/2010 12:28 PM
>Subject:
>[pkix] Unclear public-key certificate definition in X.509
>Sent by:
>[email-masked]
>
>
>
>I have proposed some modification to a paragraph in X.509 as documented
>by 
>
>
>the attached file.
> 
>I wonder whether you PKIX guys have comments on this proposal. Any
>comment 
>
>
>will be appreciated.
> 
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: [email-masked]
>Skype: andersen-erik
>http://www.x500.eu/
>http://www.x500standard.com/
>http://dk.linkedin.com/in/andersenerik
> [attachment "DR-xx.pdf" deleted by Tom Gindin/Watson/IBM]
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix
>
>
>[attachment "X509-pot-01.pdf" deleted by Tom Gindin/Watson/IBM]
>
>
>
>
>
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: "Erik Andersen" <[email-masked]>
Date: Sat, 14 Jan 2012 11:30:26 +0100

Hi Stefan,

As a Swede, you should know how to spell my name. Just think of Eriks Plan
in Stockholm (people may not know, I have a plan) and your ancient kings
named Erik.

Personally, I have a problem with the notation technique in general. It is
used in 7.2 you are referring to and in 18.2, which is a somewhat misplaced
and confusing subclause.

In 7.2 it says the same as the ASN.1 to follow, so there is an unnecessary
duplication, where a reader needs to grasp two different notation techniques
to get the same thing twice.

My preference would be to delete table one, delete the first part of 7.2 and
to rewrite some of the stuff in clause 18 and more it to a more logical
place. 

Erik Andersen
Andersen's L-Service
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/

-----Oprindelig meddelelse-----
Fra: Stefan Santesson [mailto:[email-masked]] 
Sendt: 9. januar 2012 06:44
Til: Erik Andersen; 'Tom Gindin'
Cc: 'PKIX'; 'Jean-Paul Lemaire'
Emne: Re: [pkix] Unclear public-key certificate definition in X.509

Eric,

I think you can solve the confusion with something more close to the
original and stay compliant with table 1 by choosing the term "NCA" for the
name of the CA. It would be more compatible to the chosen term "UCA"
for the unique identifier of the CA.

Using CA1 and CA(A) is just adding confusion and is not necessary to provide
the point of the text.

I would suggest:

Original text:

New text:

 Specifically, the public-key certificate of a user with distinguished name
A and unique identifier UA, produced by the CA with name NCA and and unique
identifier UCA, has the following form:

/Stefan

On 10-12-13 11:13 AM, "Erik Andersen" <[email-masked]> wrote:

>The term CA(X) was introduced already in the first edition (1988). It 
>is nothing of my doing.
>
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: [email-masked]
>Skype: andersen-erik
>http://www.x500.eu/
>I am finally back on this one. I agree with your last statement. What 
>do you think about writing CA[A] instead of CA(A)?
>
>Erik Andersen
>Andersen's L-Service
>Elsevej 48,
>DK-3500 Vaerloese
>Denmark
>Mobile: +45 2097 1490
>e-amail: [email-masked]
>Skype: andersen-erik
>http://www.x500.eu/
>a little odd to describe a certificate as a function of specifically 
>the DN of the issuer, since the critical functional dependency is on the
>The CA(A) expression just confuses me, because it suggests that the CA 
>is a function of the subject name.
>
>Tom Gindin
>
>
>
>
>
>From:
>probably others as well) to describe the CA as having name CA(A) and 
>UID UCA(A).  Would this not be easier to understand if the CA had name 
>CA(B) and ID UCA(B), or if subscripts were used?  After all, the CA is 
>a different entity than the user, and your expression has A being used 
>in both contexts.
>
>Tom Gindin
>
>
>
>
>
>From:
>[pkix] Unclear public-key certificate definition in X.509 Sent by:
>[email-masked]
>
>
>