Subject: Re: excludedSubtrees (was Re: draft-ietf-pkix-new-part1-08)

From: "Tom Gindin" <[email-masked]>
Date: Wed, 22 Aug 2001 18:47:53 -0400

Actually, I think we could stop people from playing games with
TeletexString in excludedSubtrees by requiring that any validator consider
that a TeletexString which he cannot convert to UTF-8 successfully be
considered to match any excluded subtree with that same attribute specified
as UTF8String, UniversalString, or BMPString.  That doesn't, of course,
prevent someone from adding a junk character to a Unicode encoding,
skipping accents, or such, so it's probably still bad practice.
     On a more constructive note, however, any attribute which can only be
encoded in PrintableString or NumericString (or Object ID) can safely be
used in excludedSubtrees.  The most useful of these is probably Country.

          Tom Gindin

Steve Hanna <[email-masked]>@mail.imc.org on 08/22/2001 05:17:11 PM

Sent by:  [email-masked]

To:   Peter Sylvester <[email-masked]>
cc:   [email-masked]
Subject:  Re: excludedSubtrees (was Re: draft-ietf-pkix-new-part1-08)

Peter Sylvester wrote:
> Chapter 4.1.1.11 says:
>
>    When applying restrictions of the form directoryName, an
>    implementation MUST compare DN attributes.  At a minimum,
>    implementations MUST perform the DN comparison rules specified in
>    Section 4.1.2.4.  CAs issuing certificates with a restriction of the
>    form directoryName SHOULD NOT rely on implementation of the full ISO
>    DN name comparison algorithm.  This implies name restrictions shall
>    be stated identically to the encoding used in the subject field or
>    subjectAltName extension.
>
> Does this mean that excludedSubtrees are practically unusable ?

That depends. They're still usable for name types other than
directoryName. And if you know (somehow, via some out of band mechanism)
that the relying party will only accept or trust printableString (or a
small subset of UTF8String), then you can use excludedSubtrees for
directoryName. Admittedly, that's not very likely and not good practice.
That's why the last paragraph in the Security Considerations section
talks about this problem and ends by saying "To avoid acceptance of
invalid paths, CAs SHOULD state name constraints for distinguished names
as permittedSubtrees wherever possible."

It's very hard to make excludedSubtrees work with multiple encodings (or
even with a large character set like Unicode). It's like trying to hit a
bullet with a bullet. Even if we required everyone to implement full ISO
name comparison rules for UTF8String and PrintableString, the bad guys
could encode their name with TeletexString using escape sequences or add
an accent to a character in a UTF8String or change one character in an
excluded name to another Unicode character that looks similar ...

-Steve

---

From: Steve Hanna <[email-masked]>
Date: Thu, 23 Aug 2001 10:20:04 -0400

Tom Gindin wrote:
> On a more constructive note, however, any attribute which can only
> be encoded in PrintableString or NumericString (or Object ID) can
> safely be used in excludedSubtrees.  The most useful of these is
> probably Country.

Right. So I can safely use excludedSubtrees with directoryNames as long
as the only attributes in the excluded DN are countryName, dnQualifier,
and serialNumber. But I suspect that most DNs that people would want to
exclude would contain organizationName and the like.

So I still think that using excludedSubtrees with directoryNames is
generally a bad idea. The Security Considerations section of
new-part1-08 basically says this, so I don't think any changes to the
draft are required.

-Steve