Subject: Long Name Requirements

From: [email-masked]
Date: Mon, 23 Feb 2009 15:41:53 +0200 (EET)

Hi,

I have read through the PKIX mailing list archives to find a method for
using name components longer than 64 characters in the Subject field of an
X.509 v3 certificate. Unfortunately I could not find a solution which
satisfies RFC 5280 (3280) by using standard CN, Title, O or OU components.

Now I plan to use a custom attribute-value pair in the Subject field. Is
there any widely used OID for really long names in the Subject field? I
need to put full company titles, up to 500 characters long, in the Subject
field.

Regards,

Ersin

---

From: "Erik Andersen" <[email-masked]>
Date: Mon, 23 Feb 2009 15:56:48 +0100

Hi Ersin,

In the latest edition of X.509, we removed the length restrictions on
attribute types. The PKIX group did not follow suit, but retained the length
restriction. A field of 500 characters will not comply with RFC 5280, but it
will comply with the X.509 itself, and that is what is important.

You can find links to the lasted documents on
http://www.x500standard.com/index.php?n=Extension.Ed6.

You do not need to define own attribute types.

Erik Andersen
Andersen's L-Service
Elsevej 48, DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
email: [email-masked]
www.x500.eu
www.x500standard.com

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of [email-masked]
Sent: 23. februar 2009 14:42
To: [email-masked]
Subject: Long Name Requirements

Hi,

Regards,

Ersin

---

From: Russ Housley <[email-masked]>
Date: Mon, 23 Feb 2009 10:06:30 -0500

Characters or octets?

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 23 Feb 2009 08:50:11 -0800

>will comply with the X.509 itself, and that is what is important.

Different people might have differing opinions about which standard is "important".

--Paul Hoffman, Director
--VPN Consortium

---

From: "Erik Andersen" <[email-masked]>
Date: Mon, 23 Feb 2009 18:24:10 +0100

I was not trying to rate standards, just to express that even a field is
longer than 64 characters, it still complies.

Erik Andersen
Andersen's L-Service

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: 23. februar 2009 17:50
To: Erik Andersen; [email-masked]; [email-masked]
Subject: RE: Long Name Requirements

>will comply with the X.509 itself, and that is what is important.

Different people might have differing opinions about which standard is
"important".

--Paul Hoffman, Director
--VPN Consortium

---

From: "Kemp, David P." <[email-masked]>
Date: Mon, 23 Feb 2009 13:28:43 -0500

Ersin,

While X.509 permits unlimited-length strings in the Subject field, it
may be worth considering usability before making a decision to exercise
that freedom.

>From a practical perspective, applications may handle long names with
varying degrees of grace - some may have hard-coded upper bounds based
on 5280 and will refuse to accept longer strings; others may have user
interface layouts based on length assumptions and may truncate or wrap
for display purposes without rejecting the certificate.  If you buy or
develop applications designed to handle long strings, then no problem as
long as every application that touches your certificates can handle them
properly.

>From a theoretical perspective, title (regardless of length) probably
doesn't belong in the Subject field.  The Subject name is an identifier
that tells "who" the certificate applies to.  Other information about
the user, such as height, weight, date of birth, fax number, or
title/role/position within the organization can be included in
certificates but are not semantically identifiers.  Contact information
can go either way - at the office a fax number is probably shared but
you have a private voice line that uniquely refers to you, while at home
the voice line may be shared with the wife and kids but the only fax
machine is in your home office.  If your purpose is to issue a "role
certificate" to a position without regard to who occupies the position,
then title is an identifier and does belong in the Subject name.  But in
most cases, title is an attribute of the user, not part of the user's
name.  The X.520 title attribute is most appropriately placed in the
Subject Directory Attributes extension, with the same implementation
considerations as above.  

As Eric says, defining a new attribute type is not necessary because it
would be at least as difficult to get applications to support a new type
as it would be to support the new syntax of the existing attribute.
Hopefully RFC 5280 bis will follow X.509's lead, making upper bounds
minima that implementations MUST support, not maxima that
implementations MUST NOT exceed.

I'm sure someone will point out that there is precedent for putting
almost anything you want in the Subject name, including certificate
policy statements and mpeg videos of cats.  But don't be persuaded that
everything that is syntactically valid is necessarily wise.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Erik Andersen
Sent: Monday, February 23, 2009 9:57 AM
To: [email-masked]; [email-masked]
Subject: RE: Long Name Requirements

Hi Ersin,

In the latest edition of X.509, we removed the length restrictions on
attribute types. The PKIX group did not follow suit, but retained the
length
restriction. A field of 500 characters will not comply with RFC 5280,
but it
will comply with the X.509 itself, and that is what is important.

Erik Andersen
Andersen's L-Service

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On
Behalf Of [email-masked]
Sent: 23. februar 2009 14:42
To: [email-masked]
Subject: Long Name Requirements

Hi,

I have read through the PKIX mailing list archives to find a method for
using name components longer than 64 characters in the Subject field of
an
X.509 v3 certificate. Unfortunately I could not find a solution which
satisfies RFC 5280 (3280) by using standard CN, Title, O or OU
components.

Now I plan to use a custom attribute-value pair in the Subject field. Is
there any widely used OID for really long names in the Subject field? I
need to put full company titles, up to 500 characters long, in the
Subject
field.

Regards,

Ersin

---

From: Stefan Santesson <[email-masked]>
Date: Mon, 23 Feb 2009 23:36:32 +0100

While RFC 5280 has retained upper bounds for backwards compatibility I would
not expect products on the market to enforce them. Microsoft for one does
not.

If you are applying this in a controlled environment, you could simply test
with the OS versions and applications that are being used to see if there is
any problem.

However, eventhough your description is brief, it strikes me whether it
would be more suitable to define a subjectAltName for your "long" name form
instead of throwing it into a subject attribute. It appears to me as you are
building a unique alternative identifier through this long string rather
than an attribute of a relative distinguished name structure.

/stefan

---

From: Nelson B Bolyard <[email-masked]>
Date: Mon, 23 Feb 2009 21:41:45 -0800

Stefan Santesson wrote, On 2009-02-23 14:36:
> not expect products on the market to enforce them. 

I can name products that do enforce it, when encoding a DER DN from some
(any) other form.

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 24 Feb 2009 08:12:54 +0100

Feel free to enlighten me/us.

This is of course significant even though less of an issue if its limited to
creation of certificates. I was more thinking of decoding and validation of
certificates.

/Stefan