Re: why do X.509 certificates contain context-specific tags?

According to <tom@xxxxxxx>:
Furthermore, I'll wager a bet most root level CAs are using v3 anyways.

It is easy to win a bet when the word "most" is used. Actually, last I
checked (it was several years ago, but after 2001), some of the root
CA in Windows (the ones provided with the OS) were encoded as v1
certificates.

Of course, root CA are "special" in that a root CA is a public key and a
name. The encoding of a root CA as a (often self-signed) certificate is
only a convenient tradition, but is not part of X.509 itself (and a root
CA could be easily reencoded as a v3 certificate). More to the point, it
seems that most early deployment of X.509 took place in semi-closed
environments, i.e. not as visible (to the end user) as HTTPS. As far as I
know, some "big" organizations (included the US DoD) made some wide
deployment of X.509 technology in the early times (early 90's) and this
was a strong influence on the development of X.509.


The SETs contain a single item

I personally encountered certificates with a subject DN where some of
the SETs contained _several_ elements (argl !). This does not work well
with the use of X.500 names in The Directory (the mythical construct
which trickled down into LDAP) but, unfortunately, it does exist.


Oh well...

I like to say that X.509 is the product of the inherent complexity of
what PKI are trying to achieve (because only _defining_ what type of
security features we are looking for is no easy task), and a
committee-based development which tries to tackle complexity by throwing
even more complexity at it. This can be opposed to much simpler PKI
systems (e.g. what OpenPGP describes) which tackle complexity by blindly
assuming that it does not exist, and interpret lack of actual attacks as
proofs of security.

In an ideal world, some brave people would redesign a whole, sensible
PKI format from scratch, and would succeed, and moreover the new system
would be widely adopted with a smooth and short transition phase. I do
_not_ volunteer.


--Thomas Pornin
.