Subject: Clarification on XMPP log for certificate types

From: "Blake Ramsdell" <[email-masked]>
Date: Wed, 30 Jul 2003 21:12:22 -0700

There are some comments that I've read out of the XMPP log for the WG
meeting that I'm trying to understand:

Thu Jul 17 09:21:52 2003 >ggm< Interop testing on 3279/3280
Thu Jul 17 09:22:14 2003 >ggm< scope is checking two impls can do cert
gen features, and CRLS
Thu Jul 17 09:22:21 2003 >ggm< and check path validation alg. features
Thu Jul 17 09:23:03 2003 >ggm< ADs happy with this approach.
Thu Jul 17 09:24:56 2003 >ggm< general testing: for certs/CRLS is 90%
complete. 
Thu Jul 17 09:25:18 2003 >ggm< Open issues: DSA param inheritence,
Diffie-Hellman, EC, and Delta CRLs. not changed much from last mtg

Is the point to find two implementations that can *generate* DSA
certificates with inherited parameters, Diffie-Hellman certificates,
Elliptic Curve certificates and Delta CRLs?  I know that the S/MIME
examples draft has DSA certificates with inherited parameters, and
Diffie Hellman certificates, but I don't know where those were generated
(if I had to guess, I would say the S/MIME Freeware Library).

Blake
--
Blake Ramsdell | Brute Squad Labs | http://www.brutesquadlabs.com

---

From: "Nikolas Mihalopoulos" <[email-masked]>
Date: Thu, 31 Jul 2003 18:01:52 +0300

Hello,

I am kind of new on this list and I do not know if this has been asked
before so bear with me.
RFC 3280 discusses the Issuer field on certificate and in particular the
DirectoryString type which is defined:

The DirectoryString type is defined as a choice of PrintableString,
TeletexString, BMPString, UTF8String, and UniversalString. The
UTF8String encoding [RFC 2279] is the preferred encoding, and all
certificates issued after December 31, 2003 MUST use the UTF8String
encoding of DirectoryString (except as noted below). Until that
date, conforming CAs MUST choose from the following options when
creating a distinguished name, including their own: 
(a) if the character set is sufficient, the string MAY be
represented as a PrintableString;
(b) failing (a), if the BMPString character set is sufficient the
string MAY be represented as a BMPString; and
(c) failing (a) and (b), the string MUST be represented as a
UTF8String. If (a) or (b) is satisfied, the CA MAY still choose
to represent the string as a UTF8String.
...

So if you have a CA which was created using the PrintableString before
that date what exactly would happen?

Does someone (an application/implementation) have to do something?

Is this another Y2K (or Y2.003K ) issue?

Or it just depends on your specific character string?

Thanks in advance,

****************************************
Nikolas Mihalopoulos
Security Software Engineer
Mellon Technologies
59, Panepistimiou str. 105 64 Athens Greece
Tel.: (30) 210 3727700, Fax: (30) 210 3223694
Direct:(30) 210 3727765
Email: [email-masked]
 
Disclaimer
This e-mail is confidential. If you are not the intended recipient, you
should not copy it, re-transmit it, use it or disclose its contents, but
should return it to the sender immediately and delete the copy from your
system.
 
MELLON TECHNOLOGIES SAIC cannot accept any responsibility for the
accuracy or completeness of this message as it has been transmitted over
a public network. If you suspect that the message may have been
intercepted or amended, please call the sender.
roaming signature