Re: I-D ACTION:draft-ietf-pkix-pi-06.txt

["Anders Rundgren" <anders.rundgren@xxxxxxxxx>]

In the Nordic region TTP CAs are slowly but surely supporting
a total of 15 million citizens using "implicit" PI-schemes
as described on the next line:

Subject: CN=Maria Svensson, serialNumber=43566, C=SE

Now, how should they preferably convert to using the PKIX PI profile?
(it is of some value to know that these profiles are compatible
with RFC3039 which requires DNs to be unique)


Variant 1. Redundantly storing the citizen code in each EE-cert:
Subject: CN=Maria Svensson, serialNumber=43566, C=SE
PI Assigner Authority: http://government.se/citizens
PI Value: 43566



Variant 2. Adding a nonsense disambiguer code to the subject DN:
Subject: CN=Maria Svensson, serialNumber=6, C=SE
PI Assigner Authority: http://government.se/citizens
PI Value: 43566


It there a variant 3?


Cheers,
Anders