Re: X.509 certificate and its subject name field

[<luan@xxxxxxxxxxxxxxx> (Shyh-Wei Luan)]

From: Denis Pinkas <D.Pinkas@frcl.bull.fr>

> (Shyh-Wei Luan) wrote:

> > CA names will become a scarce resource in years and need to reused.

> I would agree with that statement which would be a nice requirement ...

> > Thus I think CA's should also be assigned SUID's by their certifying CA's.

>       .... but saying that the issuer Unique ID is the solution
>            is not the right answer  ... until there is a whole story
>            about how to use/manage it.

I am not saying that "issuer UID" should be used.  As a matter of fact,
I oppose to the use of the issuer UID field.  What I am saying is that
a CA certifying other CA's can use *Subject UID* to address name reuses
(or name changes).  The following is the text that I object to.

>    CAs conforming to this profile should not reuse issuer names.
>    Therefore they should not generate cross-certificates that
>    incorporate a subject unique identifier.

For example, the US Department of Commerce can certify Company X's CA with
Subject UID 123 today and Company X's can go out of
business, say, end of this year. The Department can choose to certify a
different entity, say, 15 years later as Company X with Subject UID 456.

Shyh-Wei