<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 4/4/2022 1:02 μ.μ., Adriano Santoni
via Smcwg-public wrote:<br>
</div>
<blockquote type="cite"
cite="mid:0100017ff4070f1a-4c4b818b-f444-4e14-a834-bf8a014df034-000000@email.amazonses.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p><font face="Calibri">Hi all,</font></p>
<p><font face="Calibri">I have some doubts about this part, in
connection with IV and SV certificates:<br>
</font></p>
<blockquote type="cite"><b>7.1.4.2.2 Subject distinguished name
fields</b><br>
<br>
g. <b>Certificate Field</b>: subject:serialNumber (2.5.4.5) <br>
<b>Contents</b>: If present, the subject:serialNumber MAY be
used to contain an identifier assigned by the CA or RA to
identify and/or to disambiguate the Subscriber.<br>
</blockquote>
<br>
I'm rather dubious about "an identifier assigned by the CA or RA"
being appropriate. Unless a pseudonym is used, the Subscriber
identity should be clear to Relying Parties without a need to
query the CA or RA, which would however be necessary if such
identifier was assigned by the CA or RA and the certificate
contained no other disambiguating information.<br>
<br>
How about we decide, instead, that the subject: serialNumber MAY
contain, for disambiguating purposes, a unique identifier of the
Subscriber assigned to him/her by a government agency? It could be
taken from the identity document that has been verified according
to section 3.2.4 (Authentication of individual identity ) and
encoded according to ETSI EN 319 412-1 Section 5.1.3 (e.g.
IDCxx-nnnnn, PASxx-nnnnn, TINxx-nnnnn and so on).<br>
<p>Apart from this, it seems to me that the purpose and
requirements of this attribute are not very well explained in
the various cases (MV, IV, OV, SV). For example, since the
organizationIdentifier attribute is mandatory in the OV case,
what would be the use of having the serialNumber in the subject
as well?</p>
<p>Adriano</p>
</blockquote>
<br>
Sorry if this has already been discussed in S/MIME calls.<br>
<br>
Adriano, I don't think this is the situation today. According to
ETSI, a CA is allowed to use a unique identifier in the
subject:serialNumber field to disambiguate a natural person in
collision cases. The use of TIN, IDC, PAS, etc is obviously allowed
but not the only way to add a serialNumber. In fact, the use of
these cases are associated with the semanticsIdentifier of the
qcStatements. You can totally avoid that today and be compliant with
the ETSI profiles.<br>
<br>
Thanks,<br>
Dimitris.<br>
<br>
<blockquote type="cite"
cite="mid:0100017ff4070f1a-4c4b818b-f444-4e14-a834-bf8a014df034-000000@email.amazonses.com">
<p><br>
</p>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Smcwg-public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Smcwg-public@cabforum.org">Smcwg-public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://lists.cabforum.org/mailman/listinfo/smcwg-public">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a>
</pre>
</blockquote>
<br>
</body>
</html>