<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font face="Calibri">Hi all,</font></p>
<p><font face="Calibri">I have some doubts about this part, in
connection with IV and SV certificates:<br>
</font></p>
<blockquote type="cite"><b>7.1.4.2.2 Subject distinguished name
fields</b><br>
<br>
g. <b>Certificate Field</b>: subject:serialNumber (2.5.4.5) <br>
<b>Contents</b>: If present, the subject:serialNumber MAY be used
to contain an identifier assigned by the CA or RA to identify
and/or to disambiguate the Subscriber.<br>
</blockquote>
<br>
I'm rather dubious about "an identifier assigned by the CA or RA"
being appropriate. Unless a pseudonym is used, the Subscriber
identity should be clear to Relying Parties without a need to query
the CA or RA, which would however be necessary if such identifier
was assigned by the CA or RA and the certificate contained no other
disambiguating information.<br>
<br>
How about we decide, instead, that the subject: serialNumber MAY
contain, for disambiguating purposes, a unique identifier of the
Subscriber assigned to him/her by a government agency? It could be
taken from the identity document that has been verified according to
section 3.2.4 (Authentication of individual identity ) and encoded
according to ETSI EN 319 412-1 Section 5.1.3 (e.g. IDCxx-nnnnn,
PASxx-nnnnn, TINxx-nnnnn and so on).<br>
<p>Apart from this, it seems to me that the purpose and requirements
of this attribute are not very well explained in the various cases
(MV, IV, OV, SV). For example, since the organizationIdentifier
attribute is mandatory in the OV case, what would be the use of
having the serialNumber in the subject as well?</p>
<p>Adriano</p>
<p><br>
</p>
</body>
</html>