Re: I-D ACTION:draft-ietf-pkix-pi-10.txt

[Denis Pinkas <Denis.Pinkas@xxxxxxxx>]

Some information about the major changes done to this draft.

After side discussions initiated by Anders Rundgren and followed by Peter 
Gutmann, I have discussed with my co-editor, the PKIX chairs and the 
security Area Director.

As the result of this, the definition of the PI has been changed to allow to 
use the serialNumber attribute from the subject DN.

In the previous draft, there were 2 options or variants for the PI which was 
defined as:

  PermanentIdentifier ::=     SEQUENCE {
     identifierValue              UTF8String,
     identifierType               OBJECT IDENTIFIER      OPTIONAL
  }


In draft 10, there are now 3 options or variants for the PI which has been 
redefined as:

  PermanentIdentifier ::=     SEQUENCE {
     identifierValue    UTF8String             OPTIONAL,
                     -- if absent, use the serialNumber attribute
                        if there is a single such attribute present
                        in the subject DN
     assigner           OBJECT IDENTIFIER      OPTIONAL
                     -- if absent, the assigner is
                        the certificate issuer
   }

For further details, please take a look at the draft.

(and if you take a close look, you will find a "typo" ASN.1 error,
that will need to be corrected by re-issuing a new draft). :-(

Denis


> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.
>
> 	Title		: Internet X.509 Public Key Infrastructure Permanent Identifier
> 	Author(s)	: D. Pinkas, T. Gindin
> 	Filename	: draft-ietf-pkix-pi-10.txt
> 	Pages		: 13
> 	Date		: 2004-7-13
> 	
> This document define a new form of name, called permanent 
> identifier, that may be included in the subjectAltName extension 
> of a public key certificate issued to an entity.
> The permanent identifier is an optional feature that may be used 
> by a CA to indicate that the certificate relates to the same 
> entity even if the name or the affiliation of that entity stored 
> in the subject or another name form in the subjectAltName extension 
> has changed.
> The subject name, carried in the subject field, is only unique 
> for each subject entity certified by the one CA as defined by the 
> issuer name field. Also, the new name form can carry a 
> name that is unique for each subject entity certified by a CA.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-pkix-pi-10.txt
>
> To remove yourself from the I-D Announcement list, send a message to 
> i-d-announce-request@xxxxxxxx with the word unsubscribe in the body of the message.  
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
> to change your subscription settings.
>
>
> Internet-Drafts are also available by anonymous FTP. Login with the username
> "anonymous" and a password of your e-mail address. After logging in,
> type "cd internet-drafts" and then
> 	"get draft-ietf-pkix-pi-10.txt".
>
> A list of Internet-Drafts directories can be found in
> http://www.ietf.org/shadow.html 
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
> Internet-Drafts can also be obtained by e-mail.
>
> Send a message to:
> 	mailserv@xxxxxxxxx
> In the body type:
> 	"FILE /internet-drafts/draft-ietf-pkix-pi-10.txt".
> 	
> NOTE:	The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 		
> 		
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.