Subject: Mail addresses in S/MIME certs

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 20 Dec 1999 16:35:32 -0500

At the DC IETF meeting, Bob Jueneman brought up the issue of different 
certs for the same address. For instance, two people might use one email 
address and thus want different certificates. The current S/MIME and PKIX 
specs allow the email address, not the informational kruft around it, in 
the subjectAltName for a cert.

Do we want to change this? The arguments we heard against this in the PKIX 
group included:
- A CA might check the validity of the email address but not the name
- The many formats for the additional information are incredibly confusing 
and likely to promote lack of interoperability
The arguments in favor of using full addresses include:
- Ability for multiple people with access to the mailbox to have unique 
certificates
- Increased identification for systems that do more than just check the mailbox

Comments?

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "Frank W. Nolden" <[email-masked]>
Date: Tue, 21 Dec 1999 16:58:19 +0100

Dear All,

I would see it as follows (but then again I am very new to this discussion
and maybe I am completely off track):

When two people are using the same email address, the email address is used
as a role which can be filled by more than one person. In this case there
will be a certificate for the role and certificates for each person. The
certificates for the people will be used in private (or mail sent on
personal title) situations, while the certificate for the role will be used
in correspondence for this role only.

This means that both persons can have two certs, i.e. one for the role and
one for themselves, and each of these certs has to be stored in a separate
account or something like that.

When it is used on this way there is no problem when having the
informational stuff in the subjectAltName.
Regards,

Frank Nolden
MaXware Benelux BV

---

From: Al Arsenault <[email-masked]>
Date: Tue, 21 Dec 1999 21:50:27 -0500

> --Internet Mail Consortium

Count me in the 

"The many formats for the additional information are incredibly
confusing and likely to promote lack of interoperability"

camp.  This, combined with the fact that that cruft is almost infinitely
changeable today, and almost never checked by anybody, seems to me to be
a sure guarantee of interoperability problems.

I don't have any philosophical objections to allowing this, though, and
if the S/MIME vendors are convinced that they can get it right and make
it all interoperate, I'm willing to be outvoted.  But it just strikes me
as begging for a failure to communicate.

				Al Arsenault