Subject: DirectoryString Encoding

From: Christopher Oliva <[email-masked]>
Date: Fri, 21 May 1999 17:42:09 -0400

I have some questions about how ASN.1 encodings are to be done in
certificates etc. with respect to distinguished names and RFC 2459.

From what I understand:

1) By the year 2004 (Jan.1) all objects with attributes of DirectoryString
syntax are to be encoded (tagged) as UTF8 regardless of whether or not the
particular string being encoded has only ASCII data, printable string
characters or data outside the 7bit ascii range. Attributes not defined as
DirectoryString are to be encoded as indicated by their syntax i.e.
Ia5String attributes will be tagged as ia5String (such as dc),
printableString will be tagged as printableString (such as serialNumber).

2) Until the year 2004, the preferred technique is to use the encoding
mechanism described above however, implementers have the choice of using an
alternate encoding scheme. The alternate technique would be to use the
indicated syntax tag as described above except for DirectoryString, the
encoding would be printableString unless data outside the printableString
set is detected in which case BMPString should be used.

3) Attributes defined in various RFCs as CaseIgnoreString or CaseExactString
are to be treated as if they had been defined as DirectoryString. An example
would be RFC 1274 which defines attributes like userid (uid). This is
because those syntaxes defined in the 1988 edition of X.500 were upgraded by
the DirectoryString syntax of 1993 X.500 which has continued to be upgraded
in recent versions by including BMP and UTF8 Strings.

Is there anyone who has a different intepretation?

Chris.

-----------------------------------------
Chris Oliva
Entrust Technologies

(613) 248-3014
[email-masked]
http://www.entrust.com

Mark your calendar now for Entrust SecureSummit '99
June 14-17, Hyatt Grand Cypress Resort, Orlando, FL
-----------------------------------------