Subject: Re: Microsoft and multi-valued RDNs (was: draft minutes)

From: Stephen Kent <[email-masked]>
Date: Fri, 1 Aug 2003 10:23:07 -0400

At 17:56 -0700 7/31/03, todd glassey wrote:
>Stephen this is the fundamental failing of the IESG to not 'slap you silly'
>for this... But you nor any other WG Chair were empowered to make your WG a
>fiefdom, so it is not for you to say what is and is not a standard nor is it
>appropriate for you to make any value judgments as a WG chair as to what the
>IETF is all about. That is for its members to decide and as a member you get
>one and only one vote... and as a WG Chair you get NO votes.

As usual, you misunderstand.  The IETF is defined by its membership, 
and it empowers WG chairs, the IESG and the IAB to make value 
judgements. If the value judgements are seen to be inappropriate, 
there are appeal processes available to the parties who think they 
have been wronged.  This is true of other standards bodies as well. 
Your notion of how a standards body should operate is NOT accepted or 
practiced by any of standards bodies with which I am familiar, e.g., 
ANSI, ITU, ETSI, IEEE, ...  Because we don't formally vote on 
matters, WG chairs also are empowered to decide when WG consensus is 
achieved.  IESG members must agree on whether a given document from a 
WG is suitable as an Internet standard, which is most certainly a 
value judgement.

Standards bodies do not exist merely to generate documents; they 
exist to develop and approve documents as standards and that requires 
making choices about what to approve and what to reject. This has 
always been true, and it is true not only in the IT industry, but in 
standards bodies for construction, safety, electrical engineering, 
etc.  Why can't you understand this fundamental principle?

>WG Chairs are there (they exist) as facilitators to make sure that fair and
>open and the rest of the language about WG's and the IETF's standards
>process are implemented. Which is to say you as a WG Chair were the
>implementer of policy not its creator.

Wrong again. WG chairs are usually subject matter experts and as such 
participate in the development of the standards in their WGs.  In a 
number of instances they are even authors or co-authors of documents 
within the WGs they chair.

>Oh - as to the comment you made to me about veiled threats - I don't make
>them.
>
>Todd Glassey

Well, you have managed to fool a lot of folks in that regard, because 
that it precisely how all of your "if you keep behaving this way 
someone may sue you" comments are interpreted by many.  And, you have 
received feedback from others. not just me, saying precisely that. 
So, if your intent is not to be perceived that way, you should learn 
to rephrase yoor comments.

Steve

---

From: Peter Gietz <[email-masked]>
Date: Wed, 13 Aug 2003 12:21:58 +0200

I am not really sure on what layer this thread is being discussed, but 
my feeling is that it is rather on business and political layers than on 
a technical one.

Multi-valued RDNs are not very complicated to support, basically it is 
one more loop when analysing a DN added to the loop for the single 
RDN-components of the DN. having found a RDN, you just loop once more to 
find the single parts of a possibly multi-valued RDN. This can be 
implemented within one day in any implementation. Most LDAP libraries 
have a function called explode_RDN or similiar that helps you with this 
additional loop.

There must be other reasons for not wanting to implement that, and I 
suspect these reasons have more to do with interests in being not 100% 
compliant to a standard.

BTW: The LDAP standard is very clear about the issue. RFC 2253 says:

> RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
 >
>        RelativeDistinguishedName ::= SET SIZE (1..MAX) OF
>         AttributeTypeAndValue
> 
>        AttributeTypeAndValue ::= SEQUENCE {
>         type  AttributeType,
>         value AttributeValue }
[...]

> Where there is a multi-valued RDN, the outputs from adjoining
>    AttributeTypeAndValues are separated by a plus ('+' ASCII 43)
>    character.

RFC 3280 uses exactly the same definition:

> RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
> 
>    RelativeDistinguishedName ::=
>      SET OF AttributeTypeAndValue
> 
>    AttributeTypeAndValue ::= SEQUENCE {
>      type     AttributeType,
>      value    AttributeValue }

Very clear, very easy to implement, so what is all the fuzz about?

IETF standardization as other standardization activities is about 
interoperability. People believing in such, should at least try to 
implement the standards. There might be features that are too costly to 
implement and I would understand discussions like this thread. In this 
case the only point worth while mentioning is that Microsoft is not 
implementing multi-valued RDNs and may be to ask representatives of that 
company why they don't. In our X.509 certificate schema draft we do 
acknowledge the fact, by specifying an alternative Name Form 
(X.509issuerSerial), which BTW was not my idea. But reality check 
shouldn't go further by saying "if company X (and may be one or two 
others) don't support this, nobody should do it". This is not the IETF 
spirit. And I am very fine with WG chairs that refuse to go along these 
lines.

Cheers,

Peter

Stephen Kent wrote:

> As usual, you misunderstand.  The IETF is defined by its membership, and 
> it empowers WG chairs, the IESG and the IAB to make value judgements. If 
> the value judgements are seen to be inappropriate, there are appeal 
> processes available to the parties who think they have been wronged.  
> This is true of other standards bodies as well. Your notion of how a 
> standards body should operate is NOT accepted or practiced by any of 
> standards bodies with which I am familiar, e.g., ANSI, ITU, ETSI, IEEE, 
> ...  Because we don't formally vote on matters, WG chairs also are 
> empowered to decide when WG consensus is achieved.  IESG members must 
> agree on whether a given document from a WG is suitable as an Internet 
> standard, which is most certainly a value judgement.
> 
> Standards bodies do not exist merely to generate documents; they exist 
> to develop and approve documents as standards and that requires making 
> choices about what to approve and what to reject. This has always been 
> true, and it is true not only in the IT industry, but in standards 
> bodies for construction, safety, electrical engineering, etc.  Why can't 
> you understand this fundamental principle?
> 
> that it precisely how all of your "if you keep behaving this way someone 
> may sue you" comments are interpreted by many.  And, you have received 
> feedback from others. not just me, saying precisely that. So, if your 
> intent is not to be perceived that way, you should learn to rephrase 
> yoor comments.
> 
> Steve

-- 
_______________________________________________________________________

Peter Gietz (CEO)
DAASI International GmbH                phone: +49 7071 2970336
Wilhelmstr. 106                         Fax:   +49 7071 295114
D-72074 Tübingen                        email: [email-masked]
Germany                                 Web:   www.daasi.de

Directory Applications for Advanced Security and Information Management
_______________________________________________________________________

---

From: "todd glassey" <[email-masked]>
Date: Wed, 13 Aug 2003 08:05:43 -0700

it is peter and your comments are dead on.

Todd
----- Original Message ----- 
From: "Peter Gietz" <[email-masked]>
To: "Stephen Kent" <[email-masked]>
Cc: "todd glassey" <[email-masked]>; "Peter Gutmann"
<[email-masked]>; <[email-masked]>
Sent: Wednesday, August 13, 2003 3:21 AM
Subject: Re: Microsoft and multi-valued RDNs (was: draft minutes)

[...]

Cheers,

Peter

Peter Gietz (CEO)

---

From: "todd glassey" <[email-masked]>
Date: Wed, 13 Aug 2003 08:05:43 -0700

Todd
----- Original Message ----- 
From: "Peter Gietz" <[email-masked]>
To: "Stephen Kent" <[email-masked]>
Cc: "todd glassey" <[email-masked]>; "Peter Gutmann"

[...]

Cheers,

Peter

Peter Gietz (CEO)

---

From: "todd glassey" <[email-masked]>
Date: Wed, 13 Aug 2003 08:05:43 -0700

Todd
----- Original Message ----- 
From: "Peter Gietz" <[email-masked]>
To: "Stephen Kent" <[email-masked]>
Cc: "todd glassey" <[email-masked]>; "Peter Gutmann"

[...]

Cheers,

Peter

Peter Gietz (CEO)

---

From: Leif Johansson <[email-masked]>
Date: Wed, 27 Aug 2003 00:13:04 +0200

Peter Gietz wrote:

> my feeling is that it is rather on business and political layers than 
> on a technical one.

Probably.

> RDN-components of the DN. having found a RDN, you just loop once more 
> to find the single parts of a possibly multi-valued RDN. This can be 
> have a function called explode_RDN or similiar that helps you with 
> this additional loop.

That is not the issue. The issue is that for some reason (conspiracy, 
stupidity, whatever) lots of clients
and applications don't use this feature i.e it is not widely deployed. 
Imo the reason why multivalued
RDNs are seldom seen outside the pki community is that it is just easier 
to add another level to your
DIT. This may not be an option if you are brought up on classical 
structure rules but most LDAP
admins don't know or care about X.500! To them using multivalued RDNs is 
just added complexity
with no extra value.

There are apparently quite a few subscribers to this list who actually 
believe that pki will have any
influence on widely deployed enterprise directories. To me that is quite 
surprising.

> suspect these reasons have more to do with interests in being not 100% 
A big conspiracy eh? ;-) I'd be perfectly happy to have this thread die 
here.

       Cheers Leif