[cabfpub] Terminology/Style question

[Dimitris Zacharopoulos]

On 3/4/2017 3:39 πμ, Peter Bowen via Public wrote:
> I’m trying to draft a proposed revision to the BRs and ran into a terminology/style question.
>
> Given:
>
> Key Pair: a set of cryptographic keys, usable with an asymmetric key cryptographic algorithm, consisting of a Private Key, a Public Key, and associated parameters. For any given Private Key and parameter set, there exists exactly one associated Public Key.
>
> A Certification Authority (CA) has a single Distinguished Name (DN)[1] and one or more Key Pairs[2].  Therefore a CA has at least one Private Key and at least one Public Key and may have multiple Private Keys and Public Keys.
>
> Which of the following is preferred:
>
> A Signature is created using a Private Key.  (It is not created _by_ a Private Key.)
> 1A) A Certificate is issued by a CA when a Signature is created over a TBSCertificate with the Distinguished Name of a CA in the Issuer component using a Private Key of the CA.
> 1B) A Certificate is issued by a CA when a Signature is created over a TBSCertificate with the CA’s Distinguished Name in the Issuer component using the CA’s Private Key.
>
> A Signature is the result of signing data using a Private Key. (It is not signed _by_ a Private Key.)
> 2A) A Certificate is issued by a CA when a TBSCertificate with the Distinguished Name of a CA in the Issuer component is signed using a Private Key of the CA.
> 2B) A Certificate is issued by a CA when a TBSCertificate with the CA’s Distinguished Name in the Issuer component is signed using the CA’s Private Key.
>
> The difference been the A and B versions with whether or not to use a possessive noun with an inanimate object (the CA).
>
> I would like to use one of these consistently and follow the style for other cases.  Any one care to suggest which should be used?
>
> Thanks,
> Peter

In these examples (1A, 1B, 2A, 2B), as I read it, "issued by a CA" 
refers to the "Issuing CA" (materialized in a CA Certificate with a 
specific subject DN which is then used in the "Issuer" field of issued 
Certificates) and not the "CA" as an organization. This actually 
reflects the language of X.509 and RFC5280 which basically describe CAs 
as "Issuing CAs" rather than organizations in control of one or more 
Issuing CAs, as the BRs often suggest.

Perhaps before answering your questions, we should probably agree on 
this: If we have

  * a CA Certificate with subject DN "C=XX, O=Example Org, CN=Issuing
    CA", Certificate Serial Number A and keypair A
  * a CA Certificate with subject DN "C=XX, O=Example Org, CN=Issuing
    CA", Certificate Serial Number B and and keypair B

are we talking about the same "Issuing CA"?

Note1: You will notice that the "Certificate Serial Number" _is not_ the 
serialNumber field in the subject DN.

Note2: In order to achieve having exactly the same DN in CA Certificates 
and different keys, you probably need to use different Root hierarchies 
otherwise you would probably violate section 4.1.2.6 of RFC5280 that 
require unique DN under one Issuing CA. It the Issuing CA is a Root CA, 
then the issued CA Certificates under this Root should have unique DNs. 
Does this make sense?


Dimitris.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20170403/5d34c47a/attachment-0003.html>