<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Who cares if there are collisions in cert subjects? We already have that possibility and this doesn’t really change that.</div><div class=""><br class=""></div><div class="">Would it help if we moved the Subject Identified requirements to an overlay guideline such that the BRs only covered Internet-scope validation (e.g. just dNSName, ipAddress, SRVName, and maybe rfc822Address)?</div><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 25, 2017, at 12:22 PM, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class="">Unfortunately, that doesn't really solve the issue :(</div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Sat, Mar 25, 2017 at 3:16 PM, Ben Wilson <span dir="ltr" class=""><<a href="mailto:ben.wilson@digicert.com" target="_blank" class="">ben.wilson@digicert.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple" class=""><div class="m_-334688660769200501WordSection1"><p class="MsoNormal"><a name="m_-334688660769200501__MailEndCompose" class=""><span style="font-size:11.0pt;font-family:"Arial",sans-serif" class="">One alternative is to just drop the criterion, and then it doesn’t create an issue. “This field is also optional if the Relative Distinguished Name (RDN) matches the RDN of an organization’s registration in a national-government-adopted X.500 directory that does not contain the localityName attribute.”<u class=""></u><u class=""></u></span></a></p><p class="MsoNormal"><span class=""><b class=""><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0174c3" class=""><u class=""></u> <u class=""></u></span></b></span></p><p class="MsoNormal"><span class=""><b class=""><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#0174c3" class=""><u class=""></u> <u class=""></u></span></b></span></p><p class="MsoNormal"><span class=""><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" class=""><u class=""></u> <u class=""></u></span></span></p><span class=""></span><p class="MsoNormal"><b class=""><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" class="">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif" class=""> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank" class="">sleevi@google.com</a>] <br class=""><b class="">Sent:</b> Friday, March 24, 2017 10:28 PM<span class=""><br class=""><b class="">To:</b> Moudrick M. Dadashov <<a href="mailto:md@ssc.lt" target="_blank" class="">md@ssc.lt</a>><br class=""></span><b class="">Cc:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>>; Ben Wilson <<a href="mailto:ben.wilson@digicert.com" target="_blank" class="">ben.wilson@digicert.com</a>></span></p><div class=""><div class="h5"><br class=""><b class="">Subject:</b> Re: [cabfpub] Naming rules<u class=""></u><u class=""></u></div></div><div class=""><br class="webkit-block-placeholder"></div><div class=""><div class="h5"><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><p class="MsoNormal">Indeed, but as security specialists, we must think about the hypothetical scenarios that the rules permit - because very quickly, whether we intend to or not, we find them made manifest and causing issue. This is, of course, specific to proposals that make broad exceptions, and highlight the need to be specific in the guidance, rather than assume it won't happen.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><p class="MsoNormal">On Fri, Mar 24, 2017 at 9:22 PM, Moudrick M. Dadashov <<a href="mailto:md@ssc.lt" target="_blank" class="">md@ssc.lt</a>> wrote:<u class=""></u><u class=""></u></p><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in" class=""><div class=""><div class=""><p class="MsoNormal">Indeed, we are talking about two different things - I refer to government managed registries where D1 and D2 will maintain only data objects under their respective control.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">The case that a country can maintain a registry overlaping with (native) data objects of another jurisdiction sounds quite hypothetical.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">Thanks,<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal">M.D.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div id="m_-334688660769200501m_-4862289812829316957composer_signature" class=""><div class=""><p class="MsoNormal"><span style="font-size:10.0pt;color:#575757" class="">Sent from Samsung tablet.<u class=""></u><u class=""></u></span></p></div></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><div class=""><p class="MsoNormal"><span style="" class="">-------- Original message --------<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">From: Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank" class="">sleevi@google.com</a>> <u class=""></u><u class=""></u></span></p></div><div class=""><div class=""><div class=""><p class="MsoNormal"><span style="" class="">Date: 3/25/17 01:39 (GMT+01:00) <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">To: "Moudrick M. Dadashov" <<a href="mailto:md@ssc.lt" target="_blank" class="">md@ssc.lt</a>> <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">Cc: CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>>, Ben Wilson <<a href="mailto:ben.wilson@digicert.com" target="_blank" class="">ben.wilson@digicert.com</a>> <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">Subject: Re: [cabfpub] Naming rules <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class=""><u class=""></u> <u class=""></u></span></p></div></div></div></div><div class=""><div class=""><div class=""><p class="MsoNormal">Jurisdiction A defines an independent directory tree (D1).<u class=""></u><u class=""></u></p><div class=""><div class=""><p class="MsoNormal">Jurisdiction B defines an independent directory tree (D2).<u class=""></u><u class=""></u></p></div></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">D1 uses the naming scheme defined by Jurisdiction A<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal">D2 uses the naming scheme defined by Jurisdiction B.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">Unless you know all of the laws regarding Jurisdiction A, B, C, ... Z, and can make an effective declaration that no jurisdiction exists that defines a directory tree (D0) that conflicts with either D1 or D2, then you cannot assert that D1 or D2 are unique.<u class=""></u><u class=""></u></p></div></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><p class="MsoNormal">On Fri, Mar 24, 2017 at 8:31 PM, Moudrick M. Dadashov <<a href="mailto:md@ssc.lt" target="_blank" class="">md@ssc.lt</a>> wrote:<u class=""></u><u class=""></u></p><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in" class=""><div class=""><div class=""><p class="MsoNormal">Hi Ryan, can you give an example of 'cross-jurisdictional directory trees'?<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">Thanks,<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal">M.D.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div id="m_-334688660769200501m_-4862289812829316957m_-1807730034059743165composer_signature" class=""><div class=""><p class="MsoNormal"><span style="font-size:10.0pt;color:#575757" class="">Sent from Samsung tablet.<u class=""></u><u class=""></u></span></p></div></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><div class=""><p class="MsoNormal"><span style="" class="">-------- Original message --------<u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">From: Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank" class="">sleevi@google.com</a>> <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">Date: 3/25/17 01:15 (GMT+01:00) <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">To: "Moudrick M. Dadashov" <<a href="mailto:md@ssc.lt" target="_blank" class="">md@ssc.lt</a>> <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">Cc: CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>>, Ben Wilson <<a href="mailto:ben.wilson@digicert.com" target="_blank" class="">ben.wilson@digicert.com</a>> <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class="">Subject: Re: [cabfpub] Naming rules <u class=""></u><u class=""></u></span></p></div><div class=""><p class="MsoNormal"><span style="" class=""><u class=""></u> <u class=""></u></span></p></div></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><div class=""><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p><div class=""><p class="MsoNormal">On Fri, Mar 24, 2017 at 8:07 PM, Moudrick M. Dadashov <<a href="mailto:md@ssc.lt" target="_blank" class="">md@ssc.lt</a>> wrote:<u class=""></u><u class=""></u></p><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in" class=""><div class=""><div class=""><p class="MsoNormal">Auditor examine it through the same government adopted registry.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">In fact if government has a centralised register, there is a very little chance that the same data catogories will be maintained in two different resources - duplication of responsibilitiies is prohibited by law.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">Thanks,<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal">M.D.<u class=""></u><u class=""></u></p></div></div></blockquote><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">Hi Moudrick,<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">I'm sorry, but it may not have been clear, I was talking about cross-jurisdictional directory trees. There's nothing that would ensure their unambiguous uniqueness here, and as proposed, two entities could have X.500 DITs that reflected both _their_ jurisdiction and, more importantly, how _their_ jurisdiction views other jurisdictions.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">I believe you've misunderstood this to be about a single jurisdiction, but I was not talking about that. Auditors would have to be aware of all jurisdictions - and more importantly, all jurisdictional laws that apply or are relevant for CAs. This is much like the can of worms related to 9.16.3 in which some laws or registries only apply to specific participants.<u class=""></u><u class=""></u></p></div><div class=""><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div><div class=""><p class="MsoNormal">So while your responses would be correct for a single jurisdiction, that's not the issue :)<u class=""></u><u class=""></u></p></div></div></div></div></div></div></div></blockquote></div><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div></div></div></div></blockquote></div><p class="MsoNormal"><u class=""></u> <u class=""></u></p></div></div></div></div></div></blockquote></div><br class=""></div>
_______________________________________________<br class="">Public mailing list<br class=""><a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">https://cabforum.org/mailman/listinfo/public<br class=""></div></blockquote></div><br class=""></body></html>