Re: [Anima] representing ACP info in X.509 certs

[Stephen Kent <[e-mail]>]

Toerless,
> Dear Stephen,
>
> Thank you very much for your thoughts, but i do not think we can move
> the discussion ahead when it stops with non-technical opinion dropping
> statements like "lets not play games" (you) or "i do not think this
> is the right thing to do" (Ben/Russ).
>
> Could you please explain your assertion with technical arguments ?

The ID goes to great lengths to justify the use of the rfc822Name field 
for this context, rather than defining a new data type.  If this was the 
obvious "right" thing to do, there would not need to be so much text 
justifying the choice ("The lady doth protest too much, methinks").

I am not an AD;  I don't have a vote on this. If PKIX were still an 
active WG, and if someone came to me and asked about the choice of 
identifier in the ACP context, I would say that it was a questionable 
choice, given 25+ years of experience with PKI standards and technologies.

As I noted in a prior message, when Netscape elected to shove a DNS name 
into the common name field, it was a questionable choice, and we have 
had to live with the result for 20+ years. Elliot Lear's messages  
suggest that this choice was motivated , at least in part, by 
expediency, but he believes that sometimes expediency is an OK 
justification in these matters. Personally, I don't, but, ...

Steve