Subject: Re: Acceptance of DC-style DNs (was: OCSP I-Ds going forward)

From: [email-masked] (Peter Gutmann)
Date: Fri, 29 Nov 2002 16:15:42 +1300 (NZDT)

=?ISO-8859-1?Q?Michael_Str=F6der?= <[email-masked]> writes:

>Peter, I disagree with your opinion about acceptance of DC-style DNs. Usage
>of DNs according to RFC 2247 is getting very common in today's LDAP
>deployment.

I've never seen one, and I have a fairly wide-ranging cert collection from all
sorts of sources... there may be one in there somewhere that I've forgotten
about and I don't want to search the whole lot to find it, but from what I've
seen, usage is practically nonexistant.  You're probably correct in that usage
is necessary for LDAP deployment, but that doesn't mean that they're in common
use anywhere.

>The main problem with PKI deployment is that most PKI-enabled software does
>not support this kind of DNs.

I think the real problem is that DCs are a weird artifact of X.500 ideology
rather than any real-world issue [0].  People don't even know what to do with
a "locality" or "organisationalUnit", let alone a DC.  Even if the software
supported it, no-one would know what to do with them apart from treating them
as yet another odd blob ID.

Peter.

[0] I've tried explaning DCs to one or two people in the past when doing one
    of the PKI tutorials on my home page, and the reaction was generally head-
    shaking and comments involving the terms "OSI", "reality", and "out of
    touch with".  One guy (who had worked in an OSI environment in the past)
    asked whether 2247 was an April 1 RFC.

---

From: Michael Ströder <[email-masked]>
Date: Fri, 29 Nov 2002 04:55:06 +0100

Peter Gutmann wrote:
 > is necessary for LDAP deployment, but that doesn't mean that they're in
 > common use anywhere.

Not true. I know at least two PKIs where DC-style DNs are used. Both with a 
1:1 mapping subject DNs to LDAP DNs.

> as yet another odd blob ID.

I won't jump into the debate about whether hierarchical names making sense 
or not. That's rather a philosophical question.

The issue raised here was that DNs have to be unique. Therefore the point is 
that DNS has a world-wide operational system of naming registries. In 
opposite there's no working world-wide system of naming authorities for 
X.521 names (except some small islands in the academic community).

>     asked whether 2247 was an April 1 RFC.

Well, usually in my LDAP workshops people pick up the point quite fast. And 
I would not claim to be a better teacher than you. Usually people are more 
aware of DNS domains.

Ciao, Michael.

---

From: David Chadwick <[email-masked]>
Date: Fri, 29 Nov 2002 17:33:51 +0000

> is necessary for LDAP deployment, but that doesn't mean that they're in common

Peter 

Here is one attached to this message.

> as yet another odd blob ID.

Its not really much more weird than DNS names is it? The only difference
is that DNS name components are typeless, whereas X.500 ones are typed.

>     asked whether 2247 was an April 1 RFC.

This is completely the opposite of my experience from giving public PKI
and LDAP courses in London. People immediately see the benefit of
leveraging the DNS name registration scheme to give them globally unique
X500/LDAP DNs
Even Microsoft see the sense in this :-)

David

-- 
*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 01484 532930
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Understanding X.500:  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************