RE: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber attribute

["Manger, James H" <[e-mail]>]

Denis,
"deepest serialNumber value" meant the deepest serialNumber value, regardless of whether the RDN it was in was the deepest RDN, the 2nd deepest RDN etc.  We now both agree on the logic, so if you think my words are confusing I can live with your words.



Richard,
Including the PI extension with an absent identifierValue when the subject DN is cn="John Doe" , o="Acme Ltd" serialNumber="DUNS554433", c=US would not be sane, as you note.  However, it would not be the fault of the PI extension or the DN.  It would simply be a straight out lie by the CA.  The syntax does not (and cannot) prevent lies.


----------
From: Denis Pinkas [mailto:[e-mail]]
Sent: Monday, 26 July 2004 7:28 PM

> I still suggest using my original text changes.

Your original text was: "when identifierValue is absent the
deepest serialNumber value is used". I would guess that you mean:
"when identifierValue is absent, the value contained in the
serialNumber of the deepest RDN SHALL be used."

I would propose instead to re-use my text, modified by David,
with an additional modification for the item 2. This leads to:

1 - if there are one or more RDNs containing a serialNumber
     attribute (alone or accompanied by other attributes), then
     the value contained in the serialNumber of the deepest
     such RDN SHALL be used as the identifierValue.

2 - otherwise, the Permanent Identifier definition is invalid
     and the Permanent Identifier SHALL not be used.