[Smcwg-public] [Smcwg-management] OrganizationIdentifier & German public registers

Wed Sep 27 07:44:50 UTC 2023

Dear Dimitris,

Dear all,

My apologies, I just saw your email now. Of course I am happy to re-send the message to the public mailing list of the SMCWG as you requested, see below.

Best regards

Adrian

Adrian M. Mueller

Product Manager Certificate Services

+41 43 811 05 97

adrian.mueller at swisssign.com <mailto:adrian.mueller at swisssign.com> 

From: Smcwg-management <smcwg-management-bounces at cabforum.org> On Behalf Of Dimitris Zacharopoulos (HARICA) via Smcwg-management
Sent: Thursday, September 21, 2023 11:59 AM
To: smcwg-management at cabforum.org
Subject: Re: [Smcwg-management] OrganizationIdentifier & German public registers

On 13/9/2023 7:17 μ.μ., Adrian Mueller via Smcwg-management wrote:

Dear Stephen,

Dear all,

Upon your request I re-send my email from 22 May this year about uniqueness of German register numbers again to the list (see below). In addition, I attach my short presentation about the topic shown at the last F2F SMIME BR WG meeting in Redmond.

In a nutshell it is like this: The “EUID” is an identifier scheme regulated on EU level and is especially handy within Germany as it provides a unique identifier for registered organizations. Therefore, the organizationIdentifier “NTRDE-<EUID>” is worldwide unique.

For any questions please don’t hesitate to ask.

Hi Adrian,

Would you please re-post this to the public mailing list? The content doesn't seem to match the scope of the Member's mailing list as stated in section 5.1. of the Bylaws.

Thanks,
Dimitris.

Best regards

Adrian

Adrian M. Mueller

Product Manager Certificate Services

+41 43 811 05 97

adrian.mueller at swisssign.com <mailto:adrian.mueller at swisssign.com> 

From: Adrian Mueller 
Sent: Monday, May 22, 2023 9:29 AM
To: smcwg-management at cabforum.org <mailto:smcwg-management at cabforum.org> ; Entschew, Enrico  <mailto:e.entschew at d-trust.net> <e.entschew at d-trust.net>; Henschel, Andreas  <mailto:a.henschel at d-trust.net> <a.henschel at d-trust.net>; Wichmann, Markus Peter  <mailto:markus.wichmann at siemens.com> <markus.wichmann at siemens.com>; stefan.kirch at telekom.de <mailto:stefan.kirch at telekom.de> ; arnold.essing at telekom.de <mailto:arnold.essing at telekom.de> ; Jan.Voelkel at telekom.de <mailto:Jan.Voelkel at telekom.de> 
Subject: OrganizationIdentifier & German public registers

Dear members of the S/MIME certificate working group,

We (D-Trust, Siemens, Telekom Security & SwissSign) have discussed a specific issue regarding the new attribute “OrganizationIdentifier” (OrgID) when containing a German register number. We would like to share the results and discuss it further within the S/MIME mailing group. 

Background:

The OrganizationIdentifier attribute and its use with trade/commercial register identifiers is specified and explained in the chapters 7.1.4.2.2 d. and A.1 of the S/MIME Baseline Requirements. The standard defines the composition of such an identifier as follows (for trade registers):

1.       Prefix NTR (for “National Trade Register”) followed by the ISO-3166 alpha-2 country code, a dash ‘-‘ and the register ID itself. 
Example: NTRFR-123456789 for a French register ID (“SIREN” number)

2.       For the US and for Canada the state is included in the prefix as well. The reason is that the trade registers are maintained on the state level and the register IDs are unique at this level only.
Example: NTRUS+CA-12345678 (State of California)

Germany:

Within Germany we face the problem that trade registers and the numbers they assign are not kept on a Germany-wide level and not even on the state level either. The commercial registers are maintained by district courts (“Amtsgerichte”). Therefore, the according numbering schemes are only unique on a district level; neither the (fictional) OrganizationIdentifer NTRDE-HRA123456 nor NTRDE+NW-HRA123456 guarantee uniqueness. The register ID “HRA123456” can be assigned several times not only within Germany but even within the “Bundesland” (state) North Rhine-Westphalia (NW). 

EUID:

Therefore, in order to provide uniqueness on a Germany-wide level the register provider needs to be uniquely identified as well and a unique ID assigned to the register should be included in the OrganizationIdentifier. This is where the “EUID” comes into play. The EUID is a common format for commercial register IDs within the European Union / European Economic Area (EU/EEA). It is based upon EU legislation, see https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021R1042 <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Feur-lex.europa.eu%2Flegal-content%2FEN%2FTXT%2FPDF%2F%3Furi%3DCELEX%3A32021R1042%26from%3Den&data=05%7C01%7Cadrian.mueller%40swisssign.com%7C4945a99035c844206a0908dbba8960be%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638308871498696088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sBJvR3t%2FHSsehZ%2BZHN%2BRBHhl2YxXAPjodh0O13oiBVU%3D&reserved=0> &from=en. The identifiers may be looked up online using the European e-justice portal, see https://e-justice.europa.eu/489/EN/business_registers__search_for_a_company_in_the_eu <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fe-justice.europa.eu%2F489%2FEN%2Fbusiness_registers__search_for_a_company_in_the_eu&data=05%7C01%7Cadrian.mueller%40swisssign.com%7C4945a99035c844206a0908dbba8960be%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638308871498696088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=m58Mwph2qnB7mKzWN0yKqKsahrCEfoj%2BvvPOlO2d2Qs%3D&reserved=0> .

Example: The EUID of a company based in Cologne, state of North Rhine-Westphalia is “DER3306.HRB66812”. The components are as follows:

1.       DE                      ISO-3166-1 two-letter country code for Germany

2.       R3306                 register identifier for district court Cologne

3.       ‘.’ (dot)                as separator

4.       HRB66812           commercial register number of the company

The constructed OrganizationIdentifier is “NTRDE-DER3306.HRB66812”.

We intend to implement OrganizationIdentifiers containing German register numbers as described above. We also encourage you to follow the same approach for German register numbers in order to achieve a harmonized format.

Please note:

1.       A list containing German register court identifiers can be downloaded at https://www.xrepository.de/details/urn:xoev-de:xunternehmen:codeliste:registergerichte <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.xrepository.de%2Fdetails%2Furn%3Axoev-de%3Axunternehmen%3Acodeliste%3Aregistergerichte&data=05%7C01%7Cadrian.mueller%40swisssign.com%7C4945a99035c844206a0908dbba8960be%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638308871498696088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=3%2FWYmzYgokBf4BVnNbtzND1XXFGG6kUWWxysS3mk7tg%3D&reserved=0> .

2.       This list contains identifiers for courts acting as commercial registers (“Handelsregister”) in the strict sense and acting as other public organizational registers, e.g. registers for associations (“Vereinsregister”). Therefore, it provides flexibility with regards to the heterogeneity of the German register landscape.

3.       The EUID may be used to embed other trade register identifier schemes within the EU/EEA as well. However, the advantage/strength of adding uniqueness on the national level seems to be restricted to Germany.

If it suits the group we would like to discuss this proposal at the face-to-face meeting in Redmond. We consider the format specified above as best practice and would also like to discuss the possibility of including an according example in a future version of the S/MIME BRG.

We are looking forward to your opinion about this approach and please don’t hesitate to ask for any questions.

Best regards

Enrico Entschew, D-Trust GmbH

Andreas Hentschel, D-Trust GmbH

Markus P. Wichmann, Siemens AG

Stefan Kirch, Deutsche Telekom Security GmbH

Arnold Essing, Deutsche Telekom Security GmbH

Jan Voelkel, Deutsche Telekom Security GmbH

Adrian M. Mueller, SwissSign AG

Adrian M. Müller

Product Manager Certificate Services

+41 43 811 05 97

 <mailto:adrian.mueller at swisssign.com> adrian.mueller at swisssign.com

SwissSign AG

Sägereistrasse 25

PO Box

CH-8152 Glattbrugg
 <https://www.swisssign.com/en> swisssign.com

Don't miss out: follow us on  <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fswisssign%2F&data=05%7C01%7Cadrian.mueller%40swisssign.com%7C4945a99035c844206a0908dbba8960be%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638308871498696088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=cTD5cL0Lg%2F4i7FxOsYD5rukSSdaz2omiRFM6KrpVfjA%3D&reserved=0> LinkedIn!

Or subscribe to our  <https://www.swisssign.com/en/newsletter.html> SwissSign and  <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.swissid.ch%2Fen%2Fnewsletter.html&data=05%7C01%7Cadrian.mueller%40swisssign.com%7C4945a99035c844206a0908dbba8960be%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638308871498852319%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2FuIinl8knT6fsRdqvY0HUTRqSF2am0iDu40JRMKzdwI%3D&reserved=0> SwissID newsletter.

_______________________________________________
Smcwg-management mailing list
Smcwg-management at cabforum.org <mailto:Smcwg-management at cabforum.org> 
https://lists.cabforum.org/mailman/listinfo/smcwg-management <https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fsmcwg-management&data=05%7C01%7Cadrian.mueller%40swisssign.com%7C4945a99035c844206a0908dbba8960be%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638308871498852319%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sR62n1KQVOrOM79UvpS4PLATmc9mT260sIj8tTIMtKc%3D&reserved=0> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/smcwg-public/attachments/20230927/50169d27/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7790 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/smcwg-public/attachments/20230927/50169d27/attachment-0001.p7s>