Subject: Re: RFC2253 e-mail address

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 15 Nov 2001 13:35:52 +0100

OOOoops!
This "simple" question was apparently not that trvial..

It seems that the XMLDsig designers failed to realize that an element

        <X509SignatureCertificate
            Subject="Optional string in arbitrary interpretation"
            Issuer="Optional string in arbitrary interpretation"
            Serial="Optional integer">base64certblob</X509SignatureCerificate>

would have reduced the problem to NIL instead of going into string matching which
seems to be a real PITA and also looks like s---t.

Anders

----- Original Message -----
From: "Michael Ströder" <[email-masked]>
To: "Ramsay, Ron" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, November 15, 2001 11:22
Subject: Re: RFC2253 e-mail address

"Ramsay, Ron" wrote:
>
> So, why isn't it a real solution. You code the object identifier and wrap
> the value:
>
> 1.3.6.1.4.1.1466.115.121.1.41=#0411726f6e2e726a6d7361794063612e636f6d

Because it's unclear which BER-encoding to use for the string type?
E.g. if CN contains NON-ASCII chars and the attribute value is
encoded as T61String. Which string type to use for the BER encoding?
The answer is clear for LDAP (UTF-8-encoded Unicode wrapped in OCTET
STRING). But for PKIX?

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Thu, 15 Nov 2001 11:22:41 +0100

Ciao, Michael.