Re: Recommended change to Unique Identifier handling

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Anne Anderson <aha@east.sun.com> writes:

>There are problems with the processing of Unique Identifier values as
>currently specified in draft-ietf-pkix-new-part1-00.txt, including the
>following:
>
>a) PKIX recommends that PKIX-compliant CAs should not set Subject
>   and Issuer UID values.  This makes it impossible for certificates
>   from non-compliant CAs that use UIDs to be used as links in a
>   chain that includes certificates from compliant CAs.  This
>   creates a serious interoperability problem during the period
>   before all CAs become fully PKIX-compliant.

Given that no major[0] CA has ever used UID's, is this really an issue?  I 
assume (based on the above message) that someone somewhere is currently using 
them despite their having been deprecated for some time, but is it the job of 
PKIX to accomodate out-of-spec implementations?

Peter.

[0] "major" = visible enough that interoperability with others will be a 
    problem.