RE: TR: Request change in son-of-rfc2633

"Tony Capel" <capel@comgate.com> Wed, 29 October 2003 16:05 UTC

From: Tony Capel <capel@comgate.com>
To: 'Peter Gutmann' <pgut001@cs.aucKland.ac.nz>, aalberti@axway.com, ietf-smime@imc.org
Subject: RE: TR: Request change in son-of-rfc2633
Date: Wed, 29 Oct 2003 10:34:37 -0500
Message-ID: <000c01c39e32$2ca9ba20$01b5a8c0@tony>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
In-Reply-To: <200310290933.h9T9Xbg11033@cs.auckland.ac.nz>
Importance: Normal
Sender: owner-ietf-smime@mail.imc.org
Precedence: bulk
Content-Transfer-Encoding: 7bit

> "Alberti Antoine" <aalberti@axway.com> writes:
> 
> Actually, I even wonder what guarantees that a iAndS is unique, ...

 "Peter Gutmann" writes:
| 
| Well, firstly, X.500 theology requires that you believe that 
| all (CA) DNs are unique, and to even claim otherwise is 
| treason punishable by limb reconstruction.  In any case even 
| if you do run into a situation where two CAs choose to use 
| the same DN, the chance of the serial numbers (a 128-bit or 
| 160- bit random hash value in most cases) matching as well 
| are... slim.
| 

And also hopefully we are all practicing safe root certificate use.
We are only installing trust roots for domains that conform to our
security policy - this including appropriate obeisance to X.500
theology on the assignment of DN's (and the issue of cross certs).
Of course with root certs being downloaded as part of operating
system updates, many of us may be relying on the os vendor to do
that .....

Tony

TR: Request change in son-of-rfc2633 Alberti Antoine
Re: TR: Request change in son-of-rfc2633 Peter Gutmann
RE: TR: Request change in son-of-rfc2633 Tony Capel