Subject: PrintableString not usable tigether with OCSP?

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Sun, 10 Nov 2002 20:37:08 +0100 (CET)

Perhaps the subject is a little on the harsh side.  However, having
just implemented the rules for PrintableString and emailAddress from
RFC3280 [1] into OpenSSL, I was reminded that this in itself causes
some problems when hashes over subject or issuer is used to find a
certificate.

It could be dismissed if such hashes weren't seriously used anywhere.
However, the CertID type in RFC2560 contains exactly this kind of
hash, as the field issuerNameHash.  There may very well be cases where
two issuer names which are considered equal according to the rules
given above, but give different hashes.

Is there already a solution for this problem, or has it not been
thought of yet?  In any case, it needs to be adressed, since such DNs
do exist.  Also, there are tests in NISTs X.509 tes suite
(http://csrc.nist.gov/pki/testing/x509paths.html) where comparison if
PrintableStrings that differ in spacing and casing are present.

-----
[1] saying the PrintableString in DNs should have spaces collapsed and
    trimmed at the beginning and end of value, and considered case
    insensitive, and the emailAddress with the string type ia5String
    should be considered case insensitive...

-- 
Richard Levitte     | http://richard.levitte.org/ | Spannv. 38, I
Levitte Programming | http://www.lp.se/           | S-168 35 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"

---

From: "Ambarish Malpani" <[email-masked]>
Date: Mon, 11 Nov 2002 18:03:58 -0800

Hi Richard,
    This hasn't ever come up as a problem before.

Anyway, when writing the server at Valicert, I used the hash of
the CA's public key as the primary index to identify the CA.

We originally had the CA's full DN to allow people to identify
the CA, but one of the vendors had a strong objection to that
and so it was reduced to the hash of the CA's DN.

Ambarish

---------------------------------------------------------------------
Ambarish Malpani                                         650.759.9045
Malpani Consulting Services                      [email-masked]
http://www.malpani.biz

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Richard Levitte - VMS
> Whacker
> Sent: Sunday, November 10, 2002 11:37 AM
> To: [email-masked]
> Subject: PrintableString not usable tigether with OCSP?
> 
> 
>

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Tue, 12 Nov 2002 07:39:20 +0100 (CET)

In message <[email-masked]> on Mon, 11 Nov 2002 18:03:58 -0800, "Ambarish Malpani" <[email-masked]> said:

ambarish> 
ambarish> Hi Richard,
ambarish>     This hasn't ever come up as a problem before.

I'm glad to hear that, and that seems to reaffirm (is that the proper
term?) what Peter said...

ambarish> Anyway, when writing the server at Valicert, I used the hash of
ambarish> the CA's public key as the primary index to identify the CA.

You're talking about a different field in CertID.

ambarish> We originally had the CA's full DN to allow people to identify
ambarish> the CA, but one of the vendors had a strong objection to that
ambarish> and so it was reduced to the hash of the CA's DN.

Rereading section 4.1.2, I understand the reason (or at least one
reason).