Subject: Re: I-D ACTION:draft-ietf-pkix-certstore-http-03.txt

From: [email-masked] (Peter Gutmann)
Date: Sat, 21 Dec 2002 15:10:32 +1300

Jeff Jacoby <[email-masked]> writes:

>Is it necessary to require an exact match for all attributes, particularly
>for such attributes as the email and name attributes?

In a word, yes.

>For example, I'm looking for the cert for Bill Williams, but I don't know if
>the common name is "Bill Williams" or "Will Williams" or "B. Williams", etc,
>so I might like to try a search on just "Williams"

How would you specify this?  You'd need some sort of general-purpose pattern-
matching mechanism and then a means of mapping it to every possible backend
that might be used to implement the lookup.  The draft specifies a universal
interface to (conceptually) a basic key-and-value lookup engine, which doesn't
extend to general pattern-matching.  If you need anything more than this (for
example searching on compound attributes and similar things) you should really
use LDAP.

>Secondly, the entry for email attribute indicates the value as:
>
>  "Subject email address contained in the certificate, typically as an
>   rfc882Name attribute
>
>Is it necessary the email attribute be from the certificate.  Is it a
>reasonable or likely situation that a certificate store might use the email
>address as an database index even though it's not actually in the
>certificate?

I'd never thought of it being done like that, but I can easily change the text
to accomodate it.  How about:

  Subject email address associated with the certificate.  This is typically
  stored in the certificate as an rfc882Name attribute.

Peter.

---

From: "Tom Gindin" <[email-masked]>
Date: Mon, 23 Dec 2002 19:06:03 -0500

How about mentioning the other two normal ways of storing the email
address: "This is typically stored in the certificate either within the
subject DN as a value of one of the attributes rfc822mailbox or
emailAddress, or in the subjectAltName extension using the rfc822Name
choice of GeneralName".   I've personally never seen anyone use any other
way than those three.

            Tom Gindin

[email-masked] (Peter Gutmann)@mail.imc.org on 12/20/2002
09:10:32 PM

Sent by:    [email-masked]

To:    [email-masked], [email-masked]
cc:
Subject:    Re: I-D ACTION:draft-ietf-pkix-certstore-http-03.txt

In a word, yes.

>so I might like to try a search on just "Williams"

How would you specify this?  You'd need some sort of general-purpose
pattern-
matching mechanism and then a means of mapping it to every possible backend
that might be used to implement the lookup.  The draft specifies a
universal
interface to (conceptually) a basic key-and-value lookup engine, which
doesn't
extend to general pattern-matching.  If you need anything more than this
(for
example searching on compound attributes and similar things) you should
really
use LDAP.

>address as an database index even though it's not actually in the

I'd never thought of it being done like that, but I can easily change the
text
to accomodate it.  How about:

Peter.

---

From: [email-masked] (Peter Gutmann)
Date: Tue, 24 Dec 2002 17:44:08 +1300

"Tom Gindin" <[email-masked]> writes:

>How about mentioning the other two normal ways of storing the email address:
>"This is typically stored in the certificate either within the subject DN as
>a value of one of the attributes rfc822mailbox or emailAddress, or in the
>subjectAltName extension using the rfc822Name choice of GeneralName".

OK.

>I've personally never seen anyone use any other way than those three.

I've seen a few other oddities, but I think the above is enough for people to
get the picture - it's just meant to say "Whatever address(es) is/are
associated with the cert".

Peter.