Subject: RE: Certificates, Directories, and Distinguished Names

From: Alan Lloyd <[email-masked]>
Date: Sat, 27 Mar 1999 18:36:49 +1000

Well - this seems to highlight a problem if the name form isnt a DN and
the entity is not in a directory. 

The intent of 500/509 was that CAs are a directory entry - as per
subjects.
Attached to these entries are contact details etc - just in case of
things going wrong.

I am not to sure what going to a DNS based name does does in terms of
process - eg. validation process or things that use certificates - can
someone please enlighten me.

ie. if there are problems with Issuer DN (ie its an SMTP address in the
extensions) and I am in the process of path validation - do I mail the
Issuer with something?

What about CRLs - are they attached to these DNS indexed things.

I understand that AIAs are useful as they deal with explicit a cert
based function such as OCSP.
I just dont understand the process (that must be related to the
certficate) if DNS type names are used for issuers, etc.

In addition - if one mixed name forms in a cert path - the process rules
can get messy. eg mail here, ldap there, OCSP over there, etc 

please advise
regards alan

----------
From: Stephen Kent
To: Bob Jueneman
Cc: [email-masked]; [email-masked]; [email-masked]
Sent: 3/22/99 11:43:07 AM
Subject: Re: Certificates, Directories, and Distinguished Names

Bob,

>Because of the potential impact on evolving software, I'd like
>to escalate this issue to the PKIX co-chairs, Steve Kent and
>Warwick Ford, and to the chair of X.509, Hoyt Kesterson,
>in order to force a expeditious resolution to this issue.

We live but to serve as arbiters in such disputes :-).

>One of these name forms, at least, ought to be usable to
>retrieve a certificate from a directory, whereas the others,
>although potentially candidates for inclusion in a directory,
>may not represent a real directory entry but may be for
>display purposes to RP software, or for other application
>purposes.
>
>I believe that it is extremely important that at least one of the
>multiple name forms that may be carried in a directory reflect
>the primary directory name used to store and retrieve such
>certificates.  If I start searching a directory, I don't want to
>have to try every name in a certificate looking for other, related
>certificates.

I tend to agree that it would be good if at least one subject name could
be
used for directory lookup.  But, we have multiple directory options in
the
Internet.  If the subject name is present, it's a DN and might be
appropriate for lookup in an X.500 directory.  But, if that DN is made
up
DC attribuites, maybe it's really destined to be looked up in the DNS.
Also, if the subject name is NULL and an altName is present, that name
might be a DNS name, an RFC822 name, or an IP address, all of which are
suitable for lookup in the DNS.  So, if you are willing to allow for
both
X.500 and DNS directory lookups, it would seem that we have lots of
options
here.  I'll leave it to Hoyt to tell me where to lookup EDI party names
:-).

Steve

---

From: Stephen Kent <[email-masked]>
Date: Mon, 29 Mar 1999 15:24:18 -0500

Alan,

>someone please enlighten me.

DNS names are often native to the applications, e.g., IPsec, SSL/TLS, and
S/MIME, and thus it is preferable to make use of them as a more direct
input to an access control decision.  For example, browsers using SSL
usually match the URL against a DNS name crudely encoded as a common name.
It would be preferable (as 2459 points out) if the encoding were direct,
rather than kludged in this fashion.  Also, there are standards for storing
certs in the DNS, which might allow one to take advantage of a very large,
deployed repository infrastructure in the Internet.

>extensions) and I am in the process of path validation - do I mail the

That's not the motivation for use of DNS names here.

>What about CRLs - are they attached to these DNS indexed things.

Yes, there are provisions for storing CRLs, as well as certs, in DNS.

>certficate) if DNS type names are used for issuers, etc.

If a DNS name is used exclusively, we restrict it to the subject field for
an end entity certificate.  Otherwise a DN must be present in the Issuer
and/or Subject fields.

>can get messy. eg mail here, ldap there, OCSP over there, etc

As noted above, the simple case is to use DNS names only for end entities.

Steve