Subject: RE: Path Names to AC Holders, Targets and Proxies

From: Carlisle Adams <[email-masked]>
Date: Fri, 6 Oct 2000 11:02:57 -0400

Hi Polar,

> ----------
> From: 	Polar Humenn[SMTP:[email-masked]]
> Sent: 	Friday, October 06, 2000 10:28 AM
> To: 	[email-masked]
> Cc: 	[email-masked]; [email-masked]
> Subject: 	Path Names to AC Holders, Targets and Proxies 
> 
> Greetings IETF,
> 
> This is Polar Humenn with the Object Management Group (OMG).
> 
> I have some questions about total interoperability about the PKIX 
> Attribute Certificate when used in environments where your application
> does not have control over both clients and server, i.e. they both don't
> subscribe to the same LDAP server.
 
(...some text deleted...)

> What can we do about this problem?
> 
> I would suggest either changing the definition of GeneralName to include
> DN paths. Alternatively, I may suggest attribute extensions (critical or
> non-critical?) that complete the path from the Holder, proxies, or
> targets.
 
GeneralName already does include the full DN (not just the CN, as in your
example).

Carlisle.

---

From: Polar Humenn <[email-masked]>
Date: Fri, 6 Oct 2000 11:14:32 -0400 (EDT)

> GeneralName already does include the full DN (not just the CN, as in your

I only illustrated that with a "simple" DN, consiting of one RDN.

Am I under the false impression that DN's have structure between the
Subject of a certificate and the Issuer?

I had assumed that it can't from the mere fact that the relationship can
be idempotent, i.e. the subject and issuer can be the same DN. Which would
imply that there would have to be some recursive rule governing the
relationship on the structure. 

So, I think, and please correct me if I am wrong, it is perfectly
reasonable to have the following:

Cert 1:
Subject: "CN=Mickey Mouse, O=Disney, OU=Mousekateers"
Issuer:  "CN=Disney RA, O=A BIG CA Company, OU=DisneyRA"

Cert 2:
Subject: "CN=Disney RA, O=A BIG CA Company, OU=DisneyRA"
Issuer:  "CN=A BIGGER CA, O=Another BIGGER CA Company, L=Lamppona"

So, there is no real correlation between the subject and issuer DN's that
can be counted on within the certificate and from certificate to
certificate.

Is this correct? Please correct me if I am wrong.

If this is correct, then we have a problem with the Attribute Certificate
in the general case.

Cheers,
-Polar

-------------------------------------------------------------------
Polar Humenn                  Adiron, LLC
mailto:[email-masked]       2-212 CST      
Phone: 315-443-3171           Syracuse, NY 13244-4100
Fax:   315-443-4745           http://www.adiron.com