Subject: [pkix] Alternative distinguished names in certificates

From: "Erik Andersen" <[email-masked]>
Date: Mon, 13 Dec 2010 16:14:56 +0100

I have brought this question up before, but will try again. Can we use
alternative distinguished names in certificates? The current X.509 allows
it.

The 3rd edition of X.500 (1997) introduced a terrible concept of primary
distinguished names and alternative distinguished names. The primary
distinguished name is the good old distinguished name, while an alternative
distinguished name has context information included according to

RelativeDistinguishedName  ::=  SET SIZE (1..MAX) OF
AttributeTypeAndDistinguishedValue

AttributeTypeAndDistinguishedValue  ::=  SEQUENCE  {

             type                                          ATTRIBUTE.&id
({SupportedAttributes}),

             value
ATTRIBUTE.&Type({SupportedAttributes}{@type}),

             primaryDistinguished          BOOLEAN DEFAULT TRUE,

             valuesWithContext              SET SIZE (1..MAX) OF SEQUENCE {

                         distingAttrValue                    [0]
ATTRIBUTE.&Type ({SupportedAttributes}{@type}) OPTIONAL,

                         contextList
SET SIZE (1..MAX) OF Context } OPTIONAL }

The implication is that you, say, for a locality RDN may not only specify
its name, but things like it is in Russian spelling, only to be used on week
days, etc.

It has some complications:

Can a CA issue a certificate for a subject using an alternative
distinguished name while making sure that the subject primary distinguished
name is not used for some other subject? And what are the consequences if
the latter happens?

How does it affect proof of identity as specified by CA Browser Forum and
other forums?

I noticed that RFC 5280 has a simplified specification for RDN, which it
claims come from X.501, but that must be a very old edition of X.501.

The easy way out is to specify in X.509 that only the primary distinguished
name shall be used, but I cannot make such a change on my own
(alternatively, remove the dam concept of alternative distinguished names).

Erik Andersen

Andersen's L-Service

Elsevej 48,

DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

e-amail: [email-masked]

Skype: andersen-erik

http://www.x500.eu/

http://www.x500standard.com/

 <http://dk.linkedin.com/in/andersenerik>
http://dk.linkedin.com/in/andersenerik

---

From: Tom Gindin <[email-masked]>
Date: Mon, 20 Dec 2010 21:18:17 -0500

The existing RFC 5280 does not permit alternative distinguished 
names in Issuer or Subject.  The current RFC doesn't allow them in 
GeneralName's directoryName variant (tag 4) either, so should they be 
pushed into an OtherName or should they be allowed in directoryName?  I 
see nothing wrong with having an alternative distinguished name in 
directoryName, and thus in the Alternative Name extensions, but I'm not a 
current implementor and it wouldn't be my code that would reject 
certificates issued in good faith.

                Tom Gindin

From:
"Erik Andersen" <[email-masked]>
To:
"PKIX" <[email-masked]>
Date:
12/13/2010 10:18 AM
Subject:
[pkix] Alternative distinguished names in certificates
Sent by:
[email-masked]

The 3rd edition of X.500 (1997) introduced a terrible concept of primary 
distinguished names and alternative distinguished names. The primary 
distinguished name is the good old distinguished name, while an 
alternative distinguished name has context information included according 
to

AttributeTypeAndDistinguishedValue  ::=  SEQUENCE  {
             type                                          ATTRIBUTE.&id 
({SupportedAttributes}),
             value ATTRIBUTE.&Type({SupportedAttributes}{@type}),
             primaryDistinguished          BOOLEAN DEFAULT TRUE,
             valuesWithContext              SET SIZE (1..MAX) OF SEQUENCE 
{
                         distingAttrValue                    [0] 
ATTRIBUTE.&Type ({SupportedAttributes}{@type}) OPTIONAL,
                         contextList    SET SIZE (1..MAX) OF Context } 
OPTIONAL }
 
The implication is that you, say, for a locality RDN may not only specify 
its name, but things like it is in Russian spelling, only to be used on 
week days, etc.

Can a CA issue a certificate for a subject using an alternative 
distinguished name while making sure that the subject primary 
distinguished name is not used for some other subject? And what are the 
consequences if the latter happens?

 
The easy way out is to specify in X.509 that only the primary 
distinguished name shall be used, but I cannot make such a change on my 
own (alternatively, remove the dam concept of alternative distinguished 
names).
 
Erik Andersen
Andersen's L-Service
Elsevej 48,
DK-3500 Vaerloese
Denmark
Mobile: +45 2097 1490
e-amail: [email-masked]
Skype: andersen-erik
http://www.x500.eu/
http://www.x500standard.com/
http://dk.linkedin.com/in/andersenerik
 _______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix