Subject: UTF-8 encoding after December 31 2003

From: Stephen Kent <[email-masked]>
Date: Tue, 3 Feb 2004 13:00:18 -0500

I think the most authoritative  answer will come from the editors of 3280.

The cited portion of 3280 re accommodating the changeover to UTF8 
encoding seems straightforward at first glance, but I agree that some 
clarification would help.

Steve

---

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 5 Feb 2004 11:12:32 -0000

Russ, Tim,

What is the chance to get an authoritative answer from the editors of
3280

> -----Original Message-----

> From: Stephen Kent [mailto:[email-masked]]

> Sent: den 3 februari 2004 19:00

> To: Stefan Santesson

> Cc: [email-masked]

> Subject: UTF-8 encoding after December 31 2003

> Steve

/Stefan

________________________________

From: Stefan Santesson 
Sent: den 3 februari 2004 11:40
To: Deacon, Alex; Stefan Santesson; [email-masked]';
[email-masked]'; [email-masked]'; 'Tim Polk'; 'Russ Housley'
Subject: RE: UTF-8 encoding after December 31 2003

Thanks Alex,

With both you and Jim making the same interpretation I start to feel
hopeful that this is the actual intent of exception B).

I would appreciate though, for the record, a WG chair/editor
confirmation, but until someone comes forth and state otherwise we will
regard this as the intent of the standard.

I would also ask the editors to note for future updates to look into
eventual clarification of this text. 

/Stefan

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Deacon, Alex
Sent: den 3 februari 2004 00:36
To: Stefan Santesson; [email-masked]'; [email-masked]';
[email-masked]'; 'Tim Polk'; 'Russ Housley'
Subject: RE: UTF-8 encoding after December 31 2003

Stefan,

Based on my reading of 3280, which seems to be in line with your
interpretation, the answer to your question would be yes.  Exception b)
states that, regardless of encoding, the contents of the issuer field in
all certs issued by a CA must match the contents in its subject field.  

Alex

	-----Original Message-----
	From: Stefan Santesson [mailto:[email-masked]] 
	Sent: Friday, January 30, 2004 8:41 AM
	To: [email-masked]; [email-masked]; [email-masked]; Tim
Polk; Russ Housley
	Subject: RE: UTF-8 encoding after December 31 2003

	Due to the silence on this thread I have to restate the question
and ask for WG chairs and RFC 3280 editors' clarification:

	I'm asking for clarification on how to interpret the exceptions
to UTF-8 encoding after December 31, 2003 stated in 4.1.2.4.

	Case:

	I have a CA (root or intermediate) with an operational CA
certificate that is valid far into the future e.g. 2010. This CA
certificate has Issuer and subject name in old encoding.

	Question: 

	Is it OK to issue certificates from that CA that has an Issuer
name matching the subject name of the existing CA certificate (in old
encoding)?

	/Stefan

________________________________

	From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jim Schaad
	Sent: den 26 januari 2004 21:32
	To: Stefan Santesson; [email-masked]
	Subject: RE: UTF-8 encoding after December 31 2003

	Stefan,

	I don't read (b) in the same way as you do.  I read this as
saying if a CA has a certificate with a non-UTF8 encoded subject name,
then the issuer name in all certificates it issues MUST be the non-UTF8
subject name of the CA.  This means you don't need to update the CA
certificate, but that all new certificates issued by the CA must be
using UTF8 strings.

	jim

		-----Original Message-----
		From: [email-masked]
[mailto:[email-masked]] On Behalf Of Stefan Santesson
		Sent: Monday, January 26, 2004 9:23 AM
		To: [email-masked]
		Subject: UTF-8 encoding after December 31 2003

		All,

		I have a problem with the UTF-8 requirements in RFC 3280
after December 31, and would appreciate guidance on interpretation of
RFC 3280 as well as other implementers view on this.

		The situation:

		Conforming CA:s must encode attributes of
DirectotyString types as UTF-8 after 

		December 31, 2003.

		Exceptions are stated in RFC 3280 (section 4.1.2.4):

		   Exceptions to the December 31, 2003 UTF8 encoding
requirements are as

		   follows:

		      (a)  CAs MAY issue "name rollover" certificates to
support an

		      orderly migration to UTF8String encoding.  Such
certificates would

		      include the CA's UTF8String encoded name as issuer
and and the old

		      name encoding as subject, or vice-versa.

		      (b)  As stated in section 4.1.2.6, the subject
field MUST be

		      populated with a non-empty distinguished name
matching the

		      contents of the issuer field in all certificates
issued by the

		      subject CA regardless of encoding.

		My interpretation of this is:

		a) only applies for self issued certificates with the
same CA name as issuer and subject (but in different encodings).
Introducing such name roll-over certificates extend the certificate
chain and may be problematic since it may break both naming and path
length constraints expressed by chaining CAs.

		b) seams to be a catch 22. You can populate the subject
field with old encoding to match old encoded issuer names in descending
certificates, but since no descending CA can populate the issuer field
with old encoding it doesn't really apply.

		The issue:

		There seems to be a problem with practical reality here
in case the interpretation above is correct.

		Question 1)

		What if I have a Root CA valid to 2020 with subject and
issuer name in old encoding?

		Can that Root CA issue an intermediary CA certificate
with the issuer field in old encoding, matching the subject field of the
current root CA Certificate?

		Question 2)

		What if I have a CA with a current operating CA
certificate that expires 2006. Can this CA issue certificates after
December 31, with the issuer name in old encoding, matching the encoding
of the current CA certificate until it expires, or must this CA change
its name and have its CA certificate renewed before December 31?

		If RFC 3280 prevents operating CAs to issue certificates
with the issuer field matching the CA:s current certificate, until it
expires, then we face a huge legacy problem. Especially since name
matching for different encoding types are not required.

		4.1.2.4 states

		"(a)  attribute values encoded in different types (e.g.,

		      PrintableString and BMPString) MAY be assumed to
represent

		      different strings;"

		If my concerns are wrong and the issuing such
certificates is allowed, then this needs to be clarified.

		Stefan Santesson

		Program Manager, Windows Security

---

From: Russ Housley <[email-masked]>
Date: Sun, 08 Feb 2004 18:47:11 -0500

Stefan:

I have just had a telephone conversation with Tim Polk.  Sorry it took so 
long for this to happen.

We both agree with the interpretation already posted in this thread by Jim 
Schaad.  That is:

    If a CA has a certificate with a non-UTF8 subject name, then the issuer 
name
    in all certificates issued by that CA must use the non-UTF8 subject name of
    the CA in the issuer field.  This means you do not need to update the CA
    certificate.  All new end-entity certificates issued by the CA must use 
UTF8
   strings in the subject field.

Russ