Subject: SubjectAltName verification

From: "Martin Szotkowski" <[email-masked]>
Date: Tue, 9 May 2000 19:27:16 +0200

Hi all,
in RFC2459 (4.2.1.7) call :
>>Because the subject alternative name is considered to be definitively
bound to the publick key, all parts of the subject alternative name MUST be
verified by the CA.<<
What exactly this means?
Must be e.g. email unique in one CA? must be unique for one man?
If yes, is there any way to determine that this man has this email? (How
this problem is resolving for DNS, IP, URI, etc.?)
If no, someone can stand out for some else in email communication?

thanks for explanation
Martin

---

From: Robert Moskowitz <[email-masked]>
Date: Mon, 15 May 2000 14:09:10 -0400

>bound to the publick key, all parts of the subject alternative name MUST be

IMHO, this can only mean that the CA verifies that the content of 
SubjectAltName follows the formatting rules of the CHOICE.  That is if 
rfc822Name is used, then the rules of RFC 822 are followed.  If dNSName is 
used, than RFC 1035.  etc.

These cannot be requied to be real values, that is some SMTP server respond 
with an IDENT for the email and some DNS respond to a query.

WHY?

The mail or DNS server might be internal and unreachable to the CA.

IPsec looks at these as simple labeling formats.  This is particularly true 
for dNSName for gateways on DSL models (ie 'mobile' gateways).

>If no, someone can stand out for some else in email communication?

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]

---

From: Paul Koning <[email-masked]>
Date: Mon, 15 May 2000 14:22:06 -0400 (EDT)

>>>>> "Robert" == Robert Moskowitz <[email-masked]> writes:

 Robert> At 07:27 PM 5/9/2000 +0200, Martin Szotkowski wrote:
 >> Hi all, in RFC2459 (4.2.1.7) call : >>Because the subject
 >> alternative name is considered to be definitively bound to the
 >> publick key, all parts of the subject alternative name MUST be
 >> verified by the CA.<< What exactly this means?

 Robert> IMHO, this can only mean that the CA verifies that the
 Robert> content of SubjectAltName follows the formatting rules of the
 Robert> CHOICE.  That is if rfc822Name is used, then the rules of RFC
 Robert> 822 are followed.  If dNSName is used, than RFC 1035.  etc.

 Robert> These cannot be requied to be real values, that is some SMTP
 Robert> server respond with an IDENT for the email and some DNS
 Robert> respond to a query.

 Robert> WHY?

 Robert> The mail or DNS server might be internal and unreachable to
 Robert> the CA.

It may well be that it's hard or impossible to do more.

But this is NOT what the words quoted would suggest, not at all.
"Definitively bound to" and "verified" does not intuitively translate
to a mere syntax check.  

   paul