Subject: RE: I-D ACTION:draft-ietf-pkix-cert-utf8-00.txt

From: "Santosh Chokhani" <[email-masked]>
Date: Sat, 18 Feb 2006 21:35:33 -0800

Russ,

The new draft seems ok to me.

Any reason this is not part of 3280Bis?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Russ Housley
Sent: Saturday, February 18, 2006 6:10 PM
To: [email-masked]
Subject: Re: I-D ACTION:draft-ietf-pkix-cert-utf8-00.txt 

Dear PKIX WG:

 From the recent discussion on the mail list, it is clear to me that 
3280bis will not be done in the next few weeks.  The DirectoryString 
processing needs to be updated, and we are very late (by at least two 
years) publishing an update on this point.

I was able to get Stefan to help me write a very straightforward and 
simple draft on DirectoryString processing.  I hope that the PKIX WG 
can quickly reach consensus on this document and get it published.

Please review and comment promptly.

Russ

>A New Internet-Draft is available from the on-line Internet-Drafts 
>directories.
>This draft is a work item of the Public-Key Infrastructure (X.509) 
>Working Group of the IETF.
>
>         Title           : Update to DirectoryString Processing in the
>                           Internet X.509 Public Key Infrastructure
>                           Certificate and Certificate Revocation 
> List (CRL) Profile
>         Author(s)       : R. Housley, S. Santesson
>         Filename        : draft-ietf-pkix-cert-utf8-00.txt
>         Pages           : 5
>         Date            : 2006-2-17
>
>This document updates the handling of DirectoryString in the Internet
>X.509 Public Key Infrastructure Certificate and Certificate
>Revocation List (CRL) Profile, which is published in RFC 3280.
>
>A URL for this Internet-Draft is:
>http://www.ietf.org/internet-drafts/draft-ietf-pkix-cert-utf8-00.txt

---

From: "Stefan Santesson" <[email-masked]>
Date: Sun, 19 Feb 2006 11:39:00 -0000

The idea is that the changes of this draft will be incorporated into
rfc3280bis and that rfc 3280bis, when published will supersede this
document (rfc).

We decided to expand slightly on rfc3280bis to express the proper
guidance and rationale for the cases where it would be appropriate to
preserve legacy encoding of attributes.

As I told Russ the minute after we published this, I would propose a
slight change to the text in this draft.

Change the following text in section 4:

|  When CAs
|  have previously issued CA certificates with subject fields with
|  with attributes encoded using the TeletexString, BMPString, or
|  UniversalString, then the CA MAY continue to use these encodings
|  of the DirectoryString in renewed CA certificates to preserve
|  backward compatibility.

To:

When CAs have previously issued certificates with subject fields with
attributes encoded using the TeletexString, BMPString, or
UniversalString, then the CA MAY continue to use these encodings of the
DirectoryString in new certificates to preserve
backward compatibility.

Rationale;

I thought first that it would be sufficient to allow preservation of old
encoding of subject field attributes in CA certificates, i.e. that there
would be no reason to have legacy encoding in subject field attributes
of EE certs.

However in cases where name constraints is specified in legacy CA
certificates, that name constraining may fail unless the subject field
of the EE certificate contains matching encoding.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: den 18 februari 2006 21:36
To: [email-masked]
Subject: RE: I-D ACTION:draft-ietf-pkix-cert-utf8-00.txt 

Russ,

-----Original Message-----

Dear PKIX WG:

Russ