Subject: Confusion about encoding of attributes that use the DirectoryString type

From: "David A. Cooper" <[email-masked]>
Date: Thu, 24 Aug 2006 17:19:48 -0400

All,

It has come to the 3280bis design team's attention that there has been 
considerable confusing with respect the the rules in RFC 3280 (and 
3280bis) about the choice of string type to use when encoding attributes 
of type DirectoryString.  The source of the confusion is the syntax used 
in Appendix A of RFC 3280 (and 3280bis) to describe attributes that use 
the DirectoryString encoding.  For example, the common name attribute 
appears in Appendix A as:

      -- Naming attributes of type X520CommonName

      id-at-commonName        AttributeType ::= { id-at 3 }

      X520CommonName ::= CHOICE {
            teletexString     TeletexString   (SIZE (1..ub-common-name)),
            printableString   PrintableString (SIZE (1..ub-common-name)),
            universalString   UniversalString (SIZE (1..ub-common-name)),
            utf8String        UTF8String      (SIZE (1..ub-common-name)),
            bmpString         BMPString       (SIZE (1..ub-common-name)) }

The editors of RFC 3280 (and RFC 2459) chose to use this syntax so that 
the size constraints could be included in the ASN.1 without the need to 
use a parameterized type definition.  The X.520 definition of 
DirectoryString includes a parameter that can be used to specify the 
maximum allowable string length and the definition of each attribute 
instantiates that parameter with the maximum allowable string length for 
that attribute.  Since not all ASN.1 compilers can process parameterized 
type definitions, the PKIX profile uses the syntax show above, which has 
the same encoding and semantics as the syntax used in X.520 but is 
easier for ASN.1 compilers to process.

The problem with the syntax used in Appendix A of RFC 3280 is that the 
word "DirectoryString" does not appear.  So, many people were unaware 
that attributes such as common name used the DirectoryString type and so 
did not know that the rules in section 4.1.2.4 for the encoding of 
attributes that used the DirectoryString type applied to these attributes.

The 3280bis design team has discussed this issue and agrees that the 
ASN.1 in Appendix A should not be changed since using the syntax from 
X.520 would result in incompatibility with some ASN.1 compilers.  
Instead, the design team recommends adding comments into the ASN.1 
module prior to the definition of each attribute that uses the 
DirectoryString type that clarifies that the attribute uses the 
DirectoryString type.  A new paragraph can also be added to Appendix B 
(ASN.1 Notes) explaining the situation.

Below is a portion of Appendix A with additional comments added for the 
attributes types shown as well as the new paragraph proposed for Appendix B.

      -- Naming attributes of type X520name

      id-at-name                AttributeType ::= { id-at 41 }
      id-at-surname             AttributeType ::= { id-at  4 }
      id-at-givenName           AttributeType ::= { id-at 42 }
      id-at-initials            AttributeType ::= { id-at 43 }
      id-at-generationQualifier AttributeType ::= { id-at 44 }

      -- Naming attributes of type X520Name:
      --     X520name ::= DirectoryString (SIZE (1..ub-name))
      --
      -- Expanded to avoid parameterized type:
      X520name ::= CHOICE {
            teletexString     TeletexString   (SIZE (1..ub-name)),
            printableString   PrintableString (SIZE (1..ub-name)),
            universalString   UniversalString (SIZE (1..ub-name)),
            utf8String        UTF8String      (SIZE (1..ub-name)),
            bmpString         BMPString       (SIZE (1..ub-name)) }

      -- Naming attributes of type X520CommonName

      id-at-commonName        AttributeType ::= { id-at 3 }

      -- Naming attributes of type X520CommonName:
      --     X520CommonName :== DirectoryName (SIZE (1..ub-common-name))
      --
      -- Expanded to avoid parameterized type:
      X520CommonName ::= CHOICE {
            teletexString     TeletexString   (SIZE (1..ub-common-name)),
            printableString   PrintableString (SIZE (1..ub-common-name)),
            universalString   UniversalString (SIZE (1..ub-common-name)),
            utf8String        UTF8String      (SIZE (1..ub-common-name)),
            bmpString         BMPString       (SIZE (1..ub-common-name)) }

The following paragraph is proposed for inclusion in Appendix B:

      For many of the attribute types defined in [X.520], the 
AttributeValue uses
      the DirectoryString type.  Of the attributes specified in Appendix 
A, the name,
      surname, givenName, initials, generationQualifier, commonName, 
localityName,
      stateOrProvinceName, organizationName, organizationalUnitName, 
title, and
      pseudonym attributes all use the DirectoryString type.  X.520 uses 
a parameterized
      type definition [X.683] of DirectoryString to specify the syntax 
for each of these
      attributes.  The parameter is used to indicate the maximum string 
length allowed for
      the attribute.  In Appendix A, in order to avoid the use of 
parameterized type
      definitions, the DirectoryString type written in its expanded form 
for the definition
      of each of these attribute types.  So, the ASN.1 in Appendix A 
describes the syntax
      for each of these attributes as being a CHOICE of TeletexString, 
PrintableString,
      UniversalString, UTF8String, and BMPString, with the appropriate 
constraints on
      the string length applied to each of types in the CHOICE, rather 
than using the
      ASN.1 type DirectoryString to describe the syntax.

---

From: Tom Gindin <[email-masked]>
Date: Fri, 25 Aug 2006 19:10:25 -0400

David:

        Does it make sense to point out that the DirectoryString rules 
apply to all CHOICES containing both TeletexString and BMPString as types? 
 Both Teletex and BMP appear inside CHOICES which don't contain the other 
one, but they only appear together in DirectoryString's AFAIK.

                Tom Gindin

"David A. Cooper" <[email-masked]>
Sent by: [email-masked]
08/24/2006 05:19 PM
 
        To:     pkix <[email-masked]>
        cc: 
        Subject:        Confusion about encoding of attributes that use 
the DirectoryString type

All,

Below is a portion of Appendix A with additional comments added for the 
attributes types shown as well as the new paragraph proposed for Appendix 
B.