Re: [certid] representation and verification of identity in certificates

[Peter Saint-Andre <[e-mail]>]

On 3/10/10 9:37 AM, Paul Hoffman wrote:
> At 9:29 AM +0100 3/10/10, Simon Josefsson wrote:
>> Did you consider discussing name check rules for OpenPGP based 
>> certificate validation as well?  That is currently an
>> underspecified area, and GnuTLS had to just pick one reasonable
>> algorithm here.
>> 
>> If this is not in scope, I think it would help to clarify the scope
>> of your document if the term 'X.509' was mentioned in the abstract
>> and in section '1.2 Scope'.
> 
> Let's keep this to PKIX (not X.509, which lacks some of the alt
> attributes needed in the discussion) and also not include OpenPGP.
> Note, however, that we might learn something from the successes and
> failures in the OpenPGP world. 

The authors have consciously limited the scope of the document, at times
only because wiser heads insisted on it. While related problems are
interesting (IPsec, OpenPGP, client certs), I think we'll need to work
on those in separate documents. Perhaps someday we'll have a grand
unified theory of identity in certs/keys/etc., but not yet. :)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/