Subject: draft-ietf-pkix-new-part1-08

From: Peter Sylvester <[email-masked]>
Date: Wed, 22 Aug 2001 15:04:46 +0200 (MET DST)

Chapter 4.1.1.11 says:

   When applying restrictions of the form directoryName, an
   implementation MUST compare DN attributes.  At a minimum,
   implementations MUST perform the DN comparison rules specified in
   Section 4.1.2.4.  CAs issuing certificates with a restriction of the
   form directoryName SHOULD NOT rely on implementation of the full ISO
   DN name comparison algorithm.  This implies name restrictions shall
   be stated identically to the encoding used in the subject field or
   subjectAltName extension.

Does this mean that excludedSubtrees are practically unusable ?

---

From: Steve Hanna <[email-masked]>
Date: Wed, 22 Aug 2001 17:17:11 -0400

> Does this mean that excludedSubtrees are practically unusable ?

That depends. They're still usable for name types other than
directoryName. And if you know (somehow, via some out of band mechanism)
that the relying party will only accept or trust printableString (or a
small subset of UTF8String), then you can use excludedSubtrees for
directoryName. Admittedly, that's not very likely and not good practice.
That's why the last paragraph in the Security Considerations section
talks about this problem and ends by saying "To avoid acceptance of
invalid paths, CAs SHOULD state name constraints for distinguished names
as permittedSubtrees wherever possible."

It's very hard to make excludedSubtrees work with multiple encodings (or
even with a large character set like Unicode). It's like trying to hit a
bullet with a bullet. Even if we required everyone to implement full ISO
name comparison rules for UTF8String and PrintableString, the bad guys
could encode their name with TeletexString using escape sequences or add
an accent to a character in a UTF8String or change one character in an
excluded name to another Unicode character that looks similar ...

-Steve

---

From: "Housley, Russ" <[email-masked]>
Date: Wed, 22 Aug 2001 17:28:08 -0400

Peter:

Not completely.  It just means that you cannot rely on white space trimming 
and case changes in any character encoding other than PrintableString.

Russ