[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Can we form certificates with just name and e-mail address



Bob,

Steve/Clark :-),
(hey, don't blow my cover ...)

 >>But presumably there would only be one
 >{c=US, sP=MA, l=Cambridge, cN="Steve Kent"}+rfc822="kent@bbn.com"

 >True.  If the intent were to create multiple leaf entries below the
single entry of this form then  the justification would be better,
but I don't that's what people have been suggesting.

It's not that I particularly like compound attributes, but that's what
I was suggesting, rather than having the rfc822 be a leaf under the user name
DN.  That's what I mean to imply by the plus sign -- exactly like most
people have been suggesting for name+serial.  At least the rfc822 name
component has a great semantic content than a serial number.
Yes. But, what people were suggesting was a DN with ONLY a given name and surname, plus an e-mail address. That's a bit odd from a directory structure perspective. Obviously we would not use the first two components as RDNs under a root, since there would be no good way to separate the database base for people on a large geographic basis using those attributes. If we used the e-mail address as the first RDN it would allow for meaningful partitioning, but because the address is a composite value, it seems wrong too. It would be more appropriate to use the DC attribute to mimic the DNS structure, then put the user name as the leaf RDN. In that case, though, the given name and surname are redundant, right?

Steve