Subject: RE: 3280bis: CRL validation

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 22 Jun 2005 01:58:57 +0100

Sharon,

I fairness I don't think anything has been shown until my last comments
and quotes from X.501 has been responded to.

Let me therefore expand on this (hopefully for the last time).

What seems to cause confusion is in particular the following quote:

X.501, Clause 9.1.4 (definitions): (directory) name: A construct that 
>singles out a particular object from all other objects. A name shall be

>unambiguous (that is, denote just one object), however it need not be 
>unique (that is, be the only name which unambiguously denotes the
object).

What we need to understand is what the context is, in which the term
"object" is to be understood.

Does this refer to objects in a defined context (such as objects of a
directory) or does this mean all possible objects in the world we know?

X.501 in my reading suggests the former and I would like to suggest 3
quotes to support that:

1) The introduction of X.501 which sets the context of the standard and
defines "the directory"

"This Recommendation | International Standard, together with the other
Recommendations | International Standards, has been produced to
facilitate the interconnection of information processing systems to
provide directory services. A set of such systems, together with the
directory information that they hold, can be viewed as an integrated
whole, called the Directory."

This sets the context of the standard and states that "the Directory" is
just "a set of such systems", which not at all is the same as the whole
world.

2) The section defining the concept of objects (section 7.2) starts:

"The purpose of the Directory is to hold, and provide access to,
information about objects of interest (objects) which exist in some
'world'. An object can be anything in that world which is identifiable
(can be named)."

This clearly states that objects in the context of this standard is
limited to "objects of interest" that reflect "some 'world'", not all
possible objects and not the entire world.

3)  Section 9.2 finally sets naming of objects to be tied to the context
of the directory.

An object can be assigned a distinguished name without being represented
by an entry in the Directory, but this name is then the name its object
entry would have had were it represented in the Directory.

Conclusion:

If we recognize "the directory" as one of many possible directory
systems, and recognize that each directory system (reflected in a real
directory or just as a virtual DIT) can be served by one or more valid
CAs who issues certificates in support of that system, then all quotes
presented so far are compatible with the fact that 2 unrelated and
compliant CAs may assign the same DN to different subjects

Neither X.509, nor RFC 3280 states that all CAs in the world MUST
support a common directory (a common DIT).

This is also in line with how in fact the real world works and that is
hard to neglect.

Stefan Santesson 
Program Manager, Standards Liaison 
Windows Security 

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Sharon Boeyen
Sent: den 21 juni 2005 19:59
To: 'Denis Pinkas'; David A. Cooper
Cc: pkix
Subject: RE: 3280bis: CRL validation

Denis that is definitely a misinterpretation of X.509 - Full Stop. 

I think Dave Cooper has shown sufficient quotes to prove this fact. What
I think is true is that there does not exist a single authority globally
to ensure that DNs are unambiguous. That does not mean the assumption
isn't there in X.509 - it most definitely is. What it does mean is that,
depending on the type of DNs used and how they are structured, it
may/may not be more difficult to ensure uniqueness. It does NOT mean
name collisions should be expected.

Cheers, 
Sharon 

-----Original Message----- 
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Denis Pinkas 
Sent: Tuesday, June 21, 2005 5:33 AM 
To: David A. Cooper 
Cc: pkix 
Subject: Re: 3280bis: CRL validation 

David, 

>Stefan Santesson wrote: 

>> Show me the paragraph in X.509 or RFC 3280 that says that the subject

>> of a compliant certificate MUST have a name that corresponds to a 
>> globally unique entry in the DIT. 

>I really don't want to get involved in a discussion about whether it 
>was 
>a wise or unwise decision for X.509 to be designed around the
assumption 
>that name collisions will not occur, but here are some quotes from
X.509 
>and X.501: 

>X.509, Clause 3.2 (Directory model definitions): The following terms 
>are 
>defined in ITU-T Rec. X.501 | ISO/IEC 9594-2: f) distinguished name; 

>X.509, Section 7 (Public-keys and public-key certificates): NOTE 1 - 
>Although the CAs are unambiguously defined by a distinguished name in 
>the DIT, this does not imply that there is any relationship between the

>organization of the CAs and the DIT. 

In X.500 there is a single "DIT", whereas in X.509 there is a DIT per
CA. Full stop. 

Denis 

>X.509, Clause 8.3.2.1 (Subject alternative name extension): 
>* The values in the alternatives of the GeneralName type are names of 
>various forms as follows: 
>directoryName is a directory name defined in accordance with ITU-T Rec.

>X.501 | ISO/IEC 9594-2; 
> 
>* For every name form used in the GeneralName type, there shall be a 
>name registration system that 
>ensures that any name used unambiguously identifies one entity to both 
>certificate issuer and certificate users. 
> 
>* It is recommended that, provided the subject field of the certificate

>contains a directory name that 
>unambiguously identifies the subject, this field be flagged
non-critical. 
> 
>X.509, Clause 8.3.2.2 (Issuer alternative name extension): It is 
>recommended that, provided the issuer field of the certificate or CRL 
>contains a directory name that unambiguously identifies the issuing 
>authority, this field be flagged non-critical. 
> 
> 
> 
>X.501, Clause 9.1.4 (definitions): (directory) name: A construct that 
>singles out a particular object from all other objects. A name shall be

>unambiguous (that is, denote just one object), however it need not be 
>unique (that is, be the only name which unambiguously denotes the
object). 
> 
>X.509, Clause 9.2 (Names in General): 
> 
>A (directory) name is a construct that identifies a particular object 
>from among the set of all objects. 
>A name shall be unambiguous, that is, denotes just one object. However,

>a name need not be unique, 
>that is, be the only name that unambiguously denotes the object. A 
>(directory) name also identifies an 
>entry. This entry is either an object entry that represents the object 
>or an alias entry which contains 
>information that helps the Directory to locate the entry that
represents 
>the object. 
> 
>NOTE 1 ? The set of names of an object thus comprises the set of alias 
>names for the object, together 
>with the distinguished names of the object. 
> 
>An object can be assigned a distinguished name without being 
>represented 
>by an entry in the Directory, 
>but this name is then the name its object entry would have had were it 
>represented in the Directory. 
> 
>Syntactically, each name for an object or entry is an ordered sequence 
>of relative distinguished names (see 9.3). 
> 
>Name ::= CHOICE { -- only one possibility for now -- rdnSequence 
>RDNSequence } 
> 
>RDNSequence ::= SEQUENCE OF RelativeDistinguishedName 
> 
>DistinguishedName ::= RDNSequence 
> 
> 

Regards, 

Denis Pinkas

---

From: David Chadwick <[email-masked]>
Date: Thu, 23 Jun 2005 00:51:21 +0100

Stefan

Stefan Santesson wrote:

> limited to “objects of interest” that reflect “some ‘world’”, not all 

This is a correct interpretation. However, the "world" that we are 
interested in is the world of the Internet, therefore in the world of 
the Internet there is only one DIT (and many directory systems that 
support it). The world of the Internet is not the entire world - there 
is life outside the Internet (for some of us).

X.501 is very clear that there cannot be several of "The Directory" in 
the "some world" of interest. Since our world of interest is the 
Internet, there cannot be several DITs in the Internet.

QED

> Conclusion:
> 
> If we recognize “the directory” as one of many possible directory 
> systems,

where each one is tied to some world

> and recognize that each directory system (reflected in a real 

in different worlds of interest, not in the same world.

> support a common directory (a common DIT).

This is because there are several worlds of interest, and the Internet 
is only one. You wont find X.509 mentioning the Internet as a world or 
the world, because it applies to the Internet and to other worlds of 
interest as well - such as a NATO private network, a KGB private network 
etc.

> This is also in line with how in fact the real world works and that is 

You imply here that the Internet is the real world rather than some 
world. The Internet is not the real world. It is a virtual world.

David

> *Stefan Santesson*