Subject: Distribution Point Name Matching Rule?

From: "Wen-Cheng Wang" <[email-masked]>
Date: Fri, 14 Mar 2003 18:40:58 +0800

Hi,

In CRL processing/validation specified by both RFC 3280
and the X.509 standards, there is a requirement to at least 
match one of names (if any) in the distribution point name
field of the IDP extension of the CRL to one of the names in the
distribution point name of the CRLDP extension of the certificate.

However, it seems that neither RFC 3280 nor the X.509
standard specify the distribution point name matching rule.
Does the names need to be exactly matched? What about
case sensitivibility or whitespace ignorability?

Since both distribution point names are of GeneralNames type,
I believe that the matching rule for AuthorityAltName and
SubjectAltName could be applied to the distribution point name
matching. However, if so, please say so in the text.

It seems that we need a special section in the RFC to specify
the matching rules for GeneralNames. And then the text could
simply say that those matching rules can applied to anywhere two
GeneralNames are required to be matched.

-----
Wen-Cheng Wang
Project Researcher
Telecommunication Laboratories
Chunghwa Telecom Co., Ltd