Subject: Re: Which RFC specifies: E=[email-masked]?

From: Michael Ströder <[email-masked]>
Date: Mon, 12 Nov 2001 16:08:05 +0100

Tom Gindin wrote:
> 
> > Using "Email" or simply "E" is somewhat strange anyway. IMHO PKI
> > applications should take a look into the LDAP world where "mail"
> > (RFC 2798) and "rfc822Mailbox" (RCF 1274) is used for
> > 0.9.2342.19200300.100.1.3.
>
>      Just to add to the confusion, there's a second contender with
> identical meaning:
> emailAddress {1 2 840 113549 1 9 1}, defined in PKCS #9 (section 5.2.1 of
> version 2.0).

Uuh, yes. My fault. 1.2.840.113549.1.9.1 is the OID usually used in
certs.

Ciao, Michael.

---

From: "Tom Gindin" <[email-masked]>
Date: Mon, 12 Nov 2001 09:48:42 -0500

Tom Gindin

Michael Ströder <[email-masked]>@mail.imc.org on 11/12/2001 08:56:16
AM

Please respond to [email-masked]

Sent by:  [email-masked]

To:   Anders Rundgren <[email-masked]>
cc:   [email-masked]
Subject:  Re: Which RFC specifies: E=[email-masked]?

Anders Rundgren wrote:
>
> This is slightly more complicated in XML Dsig compared to CMS.
> In CMS the signers' certificate is specified by ASN1 data that
> normally is one-to-one of the associated certificate.  The chance
> of misinterpretation is then zero.  In XML Dsig the Issuer, Subject
> etc. are given as UTF-8 strings which must be matched against the ASN
> representation.  Although this is also the case for LDAP, I
> believe XML Dsig which is used for "machines talking to
> machines" is likely to be more hurt by the historic lack of
> stringens in DN strings.

I don't know of any authorative registry mapping the OIDs of
attribute types to unambigous strings. If XML-DSIG relies on
something which isn't exactly defined XML-DSIG is flawed.

But this does not only affect XML-DSIG. It affects all components
which handle a string representation of a subject DN. E.g. web
applications using CGI-BIN environment vars set by the SSL-capable
web server.

Ciao, Michael.