Certificate Extensions and Attributes Supporting Authentication in Point-to-Point Protocol (PPP) and Wireless Local Area Networks (WLAN)
draft-ietf-pkix-wlan-extns-05

I have two comments/questions on this draft, but I don't think that either one warrants a "discuss".

(1) If I understand correctly, the list of SSIDs that a particular certificate applies to will be passed around in the certificate itself...  The security considerations section does say (one way or the other) whether this information would be sensitive in any way.  Should I presume that it isn't?

(2) The IANA considerations section says that this document defines OIDs from the IANA-owned space.  How do we make sure that we don't have conflicts in those assignments?

Margaret

[Ballot discuss]
Since there is no guarantee of uniqueness for SSIDs,
it seems like there may be a separate step needed
when you have the "every SSID is called CORP" problem.
This text, in particular:

        The Wireless LAN (WLAN) System Service identifiers (SSIDs) public key
        certificate extension is always non-critical. It contains a list of
        SSIDs. When more than one certificate includes an extended key usage
        extension indicating that the certified public key is appropriate for
        use with the EAP in the LAN environment, the list of SSIDs MAY be
        used to select the correct certificate for authentication in a
        particular WLAN.

may need to contain text on what to do if more than one certificate
contains the same octet string as an SSID. Given that the whole
thing is a "MAY" the answer may well be "try them in turn" or
something very basic, but a note of the problem and what to do
would be useful.
                                                thanks,
                                                                Ted