Subject: What good is a DN if the REAL stuff is somewhere else?

From: "Bob Jueneman" <[email-masked]>
Date: Wed, 15 Mar 2000 13:46:13 -0700

>"What good is a DN if the REAL stuff is somewhere else?"

Anders, this is the train wreck that has been about to happen 
for ten years or more, as a result of overloading the DN and not 
using directories in the way they are typically used in practice.

Render unto Caesar that which is Caesar's, and unto the directory 
administrator as well, and don't try to get organizations to change 
their directory structures to fit your notion of what a certificate should 
look like.  It simply won't work.

As we used to say back in the NADF days, it is like trying to 
teach a pig to whistle.  It's a waste of time, and it annoys the pig!

The DN in the certificate should match whatever the DN in the directory 
is for that user, as determined by the directory administrator. Period. Finis.
Full Stop. The End. 

Otherwise, it may work, but it won't be WORKABLE.

Any other useful information, such as the user's current "real name", 
department organization ,street address, DNA encoding, or whatever, 
that needs to be in the certificate should be carried elsewhere in the 
certificate, in particular in a subjectAltName, just we do for the RFC822 
name, and for the same reasons.

Let the record show that for once I agree with Denis. :-)  And by the way, large 
organizations such as the US Navy have come to the same conclusions.

Bob

>>> "Anders Rundgren" <[email-masked]> 03/15/00 12:33PM >>>
Denis,

<snip>

>b) allowing the use of a permanent identifier for an entity, even if
>the name of the entity changes. An example of that case is "C = US ;
>OU = Delta ; OU1= Corporate ; CN= Mary White" while the permanent
>identifier would be "C = US ; OU = Delta ; SN= 12345" where 12345 is
>an employee number assigned by the Delta company. In that case Mary
>White gets married with Mr Green and becomes "Mary Green". Her
>permanent identifier does not change. Another example is that she
>moves from "Corporate" to "Marketing". Her permanent identifier does
>not change. 

What good is a DN if the REAL stuff is somewhere else?

>
>Note that the last case also allows to solve the problem of re-use
>of DN names and directory names. A DN or a directory name that has
>been used in a certificate can be re-used after the certificate that
>contained it has expired, as long as a permanent identifier, instead
>of the DN or the directory name, can be used by a relying party,
>e.g. in an ACL.

I liked your original suggestion

   http://www.imc.org/ietf-pkix/mail-archive/msg04094.html

more as it keeps DN unmistakable,   Re-use of DNs in QCs does not sound
too attractive IMO.

You original suggestion could also easily be expanded to include support for
"Preferred Display DN components" and the Naming Domain issue which so far
has beem totally neglected.

Both your solutions require a new OID to flag "enhanced" sematic interpretation.

Anders

<snip>

---

From: Robert Malick <[email-masked]>
Date: Wed, 15 Mar 2000 16:29:11 -0500 (EST)

> name, and for the same reasons.

We at National Institutes of Health have been planning our directory under
these assumptions for the past 2.5 years but have recently been
reconsidering our ways in light of the recent discussions on this list.

It has been indicated by some off the list that not having displayable
values in ones certificate subjects is not useful to current off the shelf
applications (but messes with DITs). If we were to place the displayable
value (for example "cn") in the SubjectAltName extension and yet still
have a Subject of "serialnumber=12345567890, o=ACME, c=US" would current
off the shelf clients (S/MIME and such) be inclined to show both the
Subject and SubjectAltName provided in the certificate or do vendors
usually choose over the other.

Any comments on this would be useful to us.

	Robert Malick
	National Institutes of Health