On 03/02/2011 06:46 AM, Samu Varjonen wrote:
[...]
Here is the edited paragraph
When using X.509.v3 certificates to transmit information related to
HIP hosts, HITs MAY be enclosed within the certificates. HITs can
represent an issuer, a subject, or both. In X.509.v3 HITs are
represented as issuer or subject alternative name extensions as
defined in [RFC5280]. It is REQUIRED to use the Fully Qualified
Domain Name (FQDN) [RFC1035] / Network Access Identifier (NAI)
[RFC4282], if one exists, from the hosts HOST_ID parameter in the DN.
If only the HIT of the host is presented as either the issuer or the
subject the respective HIT, from the issuer or the subject
alternative name extension, MUST be placed into the respective
entity's DN's Common Name (CN) section in a colon delimited
presentation format defined in [RFC5952]. Inclusion of CN is not
necessary if DN contains any other naming information. The full HIs
are presented in the public key entries of X.509.v3 certificates.
Samu: I am sorry, but the above is confusing and I am unable to
parse it completely.
The basic question in my original email remains.
I had a quick side conversation with the pkix chairs to ask their
view on how to proceed, and am afraid they have more questions
than answers.
I think the best thing to do may be to have a quick review with
pkix. Please realize that I am not delaying the publication of your
draft, nor hindering it. But having worked with X.509 certificates
before, I am painfully aware that unless we spell out unambiguously
what the behaviour should be, implementations will vary in their
interpretation. This will not help your draft in the long run
(even though I realize that the draft is targeted as an Experimental
RFC and not a standards-track).
The pkix WG chairs are peripherally aware of the draft through my
communication (especially Stefan Santesson), so if you open up a channel
to them I am sure that they will guide you much better. Stefan also
had good comments that I will pass on to you in a separate email.
Thanks,
- vijay
--
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60566 (USA)
Email: vkg@{bell-labs.com,acm.org} / [email protected]
Web: http://ect.bell-labs.com/who/vkg/
_______________________________________________
Gen-art mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/gen-art
