IETF Logo Mail Archive

Re: Embedded certificate image

Stefan Santesson <stefan@aaa-sec.com> Fri, 31 July 2009 19:11 UTC

Return-Path: <owner-ietf-pkix@mail.imc.org>
X-Original-To: ietfarch-pkix-archive@core3.amsl.com
Delivered-To: ietfarch-pkix-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 88AD33A6974 for <ietfarch-pkix-archive@core3.amsl.com>; Fri, 31 Jul 2009 12:11:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.75
X-Spam-Level:
X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[AWL=0.499, BAYES_00=-2.599, HELO_EQ_SE=0.35]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g5myoN3TSDt1 for <ietfarch-pkix-archive@core3.amsl.com>; Fri, 31 Jul 2009 12:11:40 -0700 (PDT)
Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id 821C13A67B1 for <pkix-archive@ietf.org>; Fri, 31 Jul 2009 12:11:40 -0700 (PDT)
Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n6VIJRFC099311 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 31 Jul 2009 11:19:27 -0700 (MST) (envelope-from owner-ietf-pkix@mail.imc.org)
Received: (from majordom@localhost) by balder-227.proper.com (8.14.2/8.13.5/Submit) id n6VIJR4E099310; Fri, 31 Jul 2009 11:19:27 -0700 (MST) (envelope-from owner-ietf-pkix@mail.imc.org)
X-Authentication-Warning: balder-227.proper.com: majordom set sender to owner-ietf-pkix@mail.imc.org using -f
Received: from s87.loopia.se (s87.loopia.se [194.9.95.113]) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id n6VIJLj2099296 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <ietf-pkix@imc.org>; Fri, 31 Jul 2009 11:19:26 -0700 (MST) (envelope-from stefan@aaa-sec.com)
Received: (qmail 13723 invoked from network); 31 Jul 2009 18:19:26 -0000
Received: from s34.loopia.se (HELO s19.loopia.se) ([194.9.94.70]) (envelope-sender <stefan@aaa-sec.com>) by s87.loopia.se (qmail-ldap-1.03) with AES256-SHA encrypted SMTP for <ietf-pkix@imc.org>; 31 Jul 2009 18:19:26 -0000
Received: (qmail 76569 invoked from network); 31 Jul 2009 18:19:17 -0000
Received: from 213-64-142-97-no153.business.telia.com (HELO [192.168.1.5]) (stefan@fiddler.nu@[213.64.142.97]) (envelope-sender <stefan@aaa-sec.com>) by s19.loopia.se (qmail-ldap-1.03) with DES-CBC3-SHA encrypted SMTP for <tmiller@mitre.org>; 31 Jul 2009 18:19:17 -0000
User-Agent: Microsoft-Entourage/12.20.0.090605
Date: Fri, 31 Jul 2009 20:19:15 +0200
Subject: Re: Embedded certificate image
From: Stefan Santesson <stefan@aaa-sec.com>
To: "Timothy J. Miller" <tmiller@mitre.org>, Santosh Chokhani <SChokhani@cygnacom.com>
CC: ietf-pkix <ietf-pkix@imc.org>
Message-ID: <C6990243.3AF2%stefan@aaa-sec.com>
Thread-Topic: Embedded certificate image
Thread-Index: AcoSC2kOpD1TXwIPLUuq89vKgQlIDQ==
In-Reply-To: <4A732267.2040204@mitre.org>
Mime-version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit
Sender: owner-ietf-pkix@mail.imc.org
Precedence: bulk
List-Archive: <http://www.imc.org/ietf-pkix/mail-archive/>
List-ID: <ietf-pkix.imc.org>
List-Unsubscribe: <mailto:ietf-pkix-request@imc.org?body=unsubscribe>

Tim,

It is not reasonable for this standard to dictate what a CA accepts as
input.

/Stefan

On 09-07-31 6:57 PM, "Timothy J. Miller" <tmiller@mitre.org> wrote:

> Santosh Chokhani wrote:
> 
>> RFC says "The relationship between the subject organization and the
>> subject
>>    organization logotype, and the relationship between the issuer and
>>    either the issuer organization logotype or the community logotype,
>>    are relationships asserted by the issuer."
>> 
>> It tends to imply that the logotype is predefined data and not in the
>> certificate request payload.
> 
> I'd feel better if it were explicit that the subject logotype is
> provided by the issuer.
> 
> As it is, I think it can be read either way.  The issuer asserts
> everything in the cert, after all, but it didn't create it all; much was
> provided by the applicant.
> 
> -- Tim

v2.46.0 | Report a Bug | By Email | System Status