Subject: Re: 3280bis: CRL validation

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 21 Jun 2005 10:32:40 +0100

David,

>Stefan Santesson wrote:

>> Show me the paragraph in X.509 or RFC 3280 that says that the subject of
>> a compliant certificate MUST have a name that corresponds to a globally
>> unique entry in the DIT.

>I really don't want to get involved in a discussion about whether it was 
>a wise or unwise decision for X.509 to be designed around the assumption 
>that name collisions will not occur, but here are some quotes from X.509 
>and X.501:

>X.509, Clause 3.2 (Directory model definitions): The following terms are 
>defined in ITU-T Rec. X.501 | ISO/IEC 9594-2: f) distinguished name;

>X.509, Section 7 (Public-keys and public-key certificates): NOTE 1 – 
>Although the CAs are unambiguously defined by a distinguished name in 
>the DIT, this does not imply that there is any relationship between the 
>organization of the CAs and the DIT.

In X.500 there is a single "DIT", whereas in X.509 there is a DIT per CA.
Full stop. 

Denis

>X.509, Clause 8.3.2.1 (Subject alternative name extension):
>* The values in the alternatives of the GeneralName type are names of 
>various forms as follows:
>directoryName is a directory name defined in accordance with ITU-T Rec. 
>X.501 | ISO/IEC 9594-2;
>
>* For every name form used in the GeneralName type, there shall be a 
>name registration system that
>ensures that any name used unambiguously identifies one entity to both 
>certificate issuer and certificate users.
>
>* It is recommended that, provided the subject field of the certificate 
>contains a directory name that
>unambiguously identifies the subject, this field be flagged non-critical.
>
>X.509, Clause 8.3.2.2 (Issuer alternative name extension): It is 
>recommended that, provided the issuer field of the certificate or CRL 
>contains a directory name that unambiguously identifies the issuing 
>authority, this field be flagged non-critical.
>
>
>
>X.501, Clause 9.1.4 (definitions): (directory) name: A construct that 
>singles out a particular object from all other objects. A name shall be 
>unambiguous (that is, denote just one object), however it need not be 
>unique (that is, be the only name which unambiguously denotes the object).
>
>X.509, Clause 9.2 (Names in General):
>
>A (directory) name is a construct that identifies a particular object 
>from among the set of all objects.
>A name shall be unambiguous, that is, denotes just one object. However, 
>a name need not be unique,
>that is, be the only name that unambiguously denotes the object. A 
>(directory) name also identifies an
>entry. This entry is either an object entry that represents the object 
>or an alias entry which contains
>information that helps the Directory to locate the entry that represents 
>the object.
>
>NOTE 1 ? The set of names of an object thus comprises the set of alias 
>names for the object, together
>with the distinguished names of the object.
>
>An object can be assigned a distinguished name without being represented 
>by an entry in the Directory,
>but this name is then the name its object entry would have had were it 
>represented in the Directory.
>
>Syntactically, each name for an object or entry is an ordered sequence 
>of relative distinguished names (see 9.3).
>
>Name ::= CHOICE { -- only one possibility for now -- rdnSequence 
>RDNSequence }
>
>RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
>
>DistinguishedName ::= RDNSequence
>
>

Regards,

Denis Pinkas

---

From: "David A. Cooper" <[email-masked]>
Date: Tue, 21 Jun 2005 09:10:13 -0400

> In X.500 there is a single "DIT", whereas in X.509 there is a DIT per CA.

Denis,

You can repeat this as many times as you like and it still won't become 
true. You keep insisting that X.509 follows a different model than 
X.500. But,

(1) X.509 states that it uses the naming model from X.501 and 
specifically states that names are unambiguous (nowhere does it say 
unambiguous relative to ....)

(2) X.501 (in clause 1, Scope) states that the concepts defined in that 
document are used in the other documents in the X.500 series, including 
X.509.

(3) The people who wrote these documents insist that they really meant 
that names in X.509 are unambiguous, and are not simply unambiguous 
relative to the issuing CA.

People have pointed this out to you over and over again in multiple 
forums and yet you continue to repeat the same false claim. No matter 
how many times you have asserted this claim, you have never be able to 
point to text in the standards to support your claim.

In X.509, not Denis' mind, names are unambiguous.

You can argue as much as you want about how X.509 SHOULD HAVE been based 
on locally distinct names, but there is a difference between "should 
have" and "did".

If you are going to continue to claim that X.509 WAS written around the 
assumption that naming is local, then please explain:

(1) Why the text states that names are unambiguous without indicating 
that names are only unambiguous within a certain scope.

(2) Why all of these rules that you have noted would need to be enforced 
in order to ensure security in an environment in which names are only 
distinct with respect to the issuing CA were not included in the standard.

(3) Why the people who actually developed and wrote the standard claim 
that X.509 was written based on the assumption that names are globally 
unambiguous (just as the standard states).

Dave