Subject: Re: What good is a DN if the REAL stuff is somewhere else?

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 15 Mar 2000 15:12:34 -0700

Robert,

I would expect that nearly all such products would be 
capable of displaying the name as part of their general 
certificate display capability.

What I believe you are asking is a different issue, however, 
and that is what name would typically be displayed as 
the banner of an e-mail message, and/or matched against 
the e-mail address.

That's a different problem, and one that so far hasn't been 
solved very well, in part because of the reluctance of the 
IETF to meddle with GUI issues.

But it is, I believe, at the heart of the believability and 
workability issue for the general consumer of certificates, 
i.e., the non-specialist.

At present, neither my DN (bjueneman.nsrd.prv.novell) nor 
my email address ([email-masked]) is particularly 
meaningful, and if novell were replaced by say AOL, it would 
be even less meaningful unless you already knew me.

And note that I could change my From address to 
"President William Clinton
                                                                                   "<[email-masked]> 
and no e-mail program that I know of would display the From 
address correctly. The naive user could then be fooled into believing 
the message was really from Pres. Clinton.

My personal advice would be to stick to your guns regarding the
directory problem, and apply pressure to the various vendors (including
us, mea culpa) to solve this display problem.

The PKIX standard allows multiple subjectAltNames, including
a GeneralizedName construct.  We should take advantage of it.

Regards,

Bob

>>> Robert Malick <[email-masked]> 03/15/00 02:29PM >>>

On Wed, 15 Mar 2000, Bob Jueneman wrote:

> The DN in the certificate should match whatever the DN in the directory 
> is for that user, as determined by the directory administrator. Period. Finis.
> Full Stop. The End. 
> 
> Otherwise, it may work, but it won't be WORKABLE.
> 
> Any other useful information, such as the user's current "real name", 
> department organization ,street address, DNA encoding, or whatever, 
> that needs to be in the certificate should be carried elsewhere in the 
> certificate, in particular in a subjectAltName, just we do for the RFC822 
> name, and for the same reasons.

We at National Institutes of Health have been planning our directory under
these assumptions for the past 2.5 years but have recently been
reconsidering our ways in light of the recent discussions on this list.

It has been indicated by some off the list that not having displayable
values in ones certificate subjects is not useful to current off the shelf
applications (but messes with DITs). If we were to place the displayable
value (for example "cn") in the SubjectAltName extension and yet still
have a Subject of "serialnumber=12345567890, o=ACME, c=US" would current
off the shelf clients (S/MIME and such) be inclined to show both the
Subject and SubjectAltName provided in the certificate or do vendors
usually choose over the other.

Any comments on this would be useful to us.

	Robert Malick
	National Institutes of Health

---

From: "David P. Kemp" <[email-masked]>
Date: Thu, 16 Mar 2000 09:22:28 -0500 (EST)

> Date: Wed, 15 Mar 2000 13:46:13 -0700
> From: "Bob Jueneman" <[email-masked]>
> To: <[email-masked]>, <[email-masked]>, 
<[email-masked]>
> Cc: <[email-masked]>
>   [...]

The same objective could be accomplished by putting the user's display
name in Certificate:subject, and the directory name in, ummm,
subjectAltName:directoryName.