Subject: RE: Comments on draft-ietf-pkix-cert-utf8-01.txt

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 1 Mar 2006 17:34:37 -0000

On last issue, Subject and Issuer Alt Names I suggest we stay silent.

This draft is only concerned with fixing the false/bad utf-8 requirement
from RFC 3280. That text in rfc 3280 did not cover alt names so it
doesn't need fixing.

The only alt name that has directoryString encoding is EDI Party name
which is totally non relevant from a chaining and name constraints
perspective.

OtherName names should/could have their own conventions defined that we
don't want to mess with.

If something needs be said anyway, I suggest we do that in rfc 3280bis.
Better to keep this small draft focused.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Russ Housley
Sent: den 1 mars 2006 16:36
To: Jim Schaad; [email-masked]
Subject: Re: Comments on draft-ietf-pkix-cert-utf8-01.txt

Jim:

Thanks for the first WG Last Call comments.

>1.  Page 2 last paragraph:  "issuer and and the old" - remove duplicate
>"and"

Agree.  It will be included in the next revision.

>2.  Inclusion of the section title would improve the readablity of the
>document.

Agree.  It will be included in the next revision.

>3.  Text dealing with connocalization (or the non-requirement for)
should be
>included in the document.

Why?  That part of the text is unchanged.  This document cannot be 
understood without the rest of RFC 3280.

>4.  Does any text regarding Subject and issuer Alt Names need to be
>included?

Good question.  I asked this question when I read Santosh's posting, 
but no one has responded.  My initial reaction is that we should add 
it, but I would like to hear what others think.

Russ

---

From: Russ Housley <[email-masked]>
Date: Wed, 01 Mar 2006 13:24:11 -0500

Stefan:

You are correct.

Here is what RFC 3280 says about subjectAltNames that contain DNs:

    When the subjectAltName extension contains a DN in the directoryName,
    the DN MUST be unique for each subject entity certified by the one CA
    as defined by the issuer name field.  A CA MAY issue more than one
    certificate with the same DN to the same subject entity.

It does not say anything about encoding.  The only value we can add 
would be to require that the conventions for encoding subject be followed.

Russ