Subject: NameConstraints clarifications needed

From: Anne Anderson <[email-masked]>
Date: Mon, 20 Mar 2000 13:52:43 -0500 (EST)

I have identified two possible clarifications needed with
NameConstraints.

1. For DNS names, is there any way to constrain the permitted or
   excluded SubjectAlternativeNames to a single host?

   According to both RFC2459 and draft-ietf-pkix-new-part1-01.txt, a
   constraint of the form foo.bar.com would permit or exclude not
   only foo.bar.com, but also www.foo.bar.com and wwwfoo.bar.com.

   Note that this differs from the treatment of DNS names when they
   are included in names of type UniformResourceIdentifier or
   RFC822Name.  In these name types, the DNS name portion must be
   preceded by "." in order to include subdomains; otherwise, the
   DNS name constraint specifies only the specified host.

2. For NameConstraints of type UniformResourceIdentifier, if the
   host name is specified as an IPAddress, can that IPAddress be a
   range of addresses (e.g. 10.9.8.0/255.255.255.0)?  The text
   states "When the constraint does not begin with a period, it
   specifies a host," but this is in a context of discussing only
   host names of type DNS name, so it is not entirely clear.

Anne
-- 
Anne H. Anderson             Email: [email-masked]
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692