Subject: PKIX: DNS name constraint in Cert. Profile (Sept. 23, 1998)

From: "Manger, James" <[email-masked]>
Date: Tue, 6 Oct 1998 11:17:32 +1000

<draft-ietf-pkix-ipki-part1-11.txt>
At a quick glance the latest draft looks good.  The Name Constraints clause
(4.2.1.11) has been tightened up for URIs but the same is needed for DNS
restrictions.  The relevant text is quoted below.  A constraint
"foo.bar.com" should NOT be satisfied by "bigfoo.bar.com", yet this is
constructed "by simply adding to the left hand side" so it does satisfy the
constraint according to the draft.

Either require a leading period in the constraint, e.g. ".foo.bar.com" (c.f.
URI constraint); or replace the "adding to the left" sentence with "Any
sub-domain satisfies the constraint.".  Change "foo1.bar.com" to
"bigfoo.bar.com" as an example that does not satisfy the constraint.

-----
INTERNET DRAFT                                        September 23, 1998

4.2.1.11  Name Constraints

   ...

   DNS name restrictions are expressed as foo.bar.com. Any DNS name that
   can be constructed by simply adding to the left hand side of the name
   satisfies the name constraint. For example, www.foo.bar.com would
   satisfy the constraint but foo1.bar.com would not.

   ...

Housley, Ford, Polk, & Solo                                    [Page 36]

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 06 Oct 1998 08:01:35 -0700

>"bigfoo.bar.com" as an example that does not satisfy the constraint.

Extremely good point, and I believe that the latter ("any subdomain...")
should be used. If this clarification can be made before the RFC is issued,
it should be; otherwise, we should probably be starting a "clarifications"
draft and this should be in it.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Jacques Lebastard <[email-masked]>
Date: Tue, 06 Oct 1998 17:37:42 +0200

I'm looking for the Standard document defining the format
of a DNS name. Does such an Internet RFC exist ?
-- 
Jacques LEBASTARD                 mailto:[email-masked]
BULL SA - ISM AccessMaster          http://www.openmaster.com/
Rue Jean Jaures - F3-2G-03           Tel: +33 1 30 80 77 86
F-78340 Les Clayes sous Bois         Fax: +33 1 30 80 77 99