Subject: RE: RFC2253 e-mail address

From: "Ramsay, Ron" <[email-masked]>
Date: Thu, 15 Nov 2001 13:47:06 +1100

Michael,

You may be right. I know there was some concern in LDAP about servers being
able to understand DNs, particularly when they support chaining and the
server for which the DN was meant could understand it. For interoperabilty
(and, in your case, portability), the attributes used in DNs should be
restricted the geographical ones occurring in the X.500 examples.

Ron.

-----Original Message-----
From: Michael Ströder [mailto:[email-masked]]
Sent: Thursday, 15 November 2001 12:57
To: Ramsay, Ron
Cc: [email-masked]
Subject: Re: RFC2253 e-mail address

"Ramsay, Ron" wrote:
> 
> For true interoperability, some believe you should only use the name forms
> for the attributes in the table in 2.3. This would be the baseline for
> interoperability. To encode an ascii string in BER for this case, you
might
> think that the X.500 version of directory string would be meant, this
would
> result in the encoding 16 04 41 42 43 44 as the encoding of "ABCD".
However,
> I think all that LDAP requires is an octet string wrapper, when the
encoding
> would be 04 04 41 42 43 44.

Ron, you raise another issue which BER encoding is used. For me the
conclusion is that RFC 2253 is not sufficient to represent
certificate subject and issuer names in e.g. XML-DSIG.

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Thu, 15 Nov 2001 04:07:15 +0100

> restricted the geographical ones occurring in the X.500 examples.

But that's not a real solution since a sender implementation would
be free to also use hex-string BER-encoding for the classical X.500
attributes still being compliant to RFC 2253.

Ciao, Michael.