Subject: RE: RFC 3280 bug in name constraints

From: "Stefan Santesson" <[email-masked]>
Date: Thu, 6 May 2004 17:16:31 +0100

I agree with Sharon here.

Even though it may sound logical to always also constrain e-mail
attributes, changing the standard in this aspect will just break many
current implementations and I don't think there is enough motivation for
it.

I too just see it necessary if no rfc822Name is present. 

/Stefan

> -----Original Message-----
> From: Sharon Boeyen [mailto:[email-masked]]
> Sent: den 6 maj 2004 08:38
> To: 'Steve Hanna'; Stefan Santesson
> Cc: [email-masked]
> Subject: RE: RFC 3280 bug in name constraints
> 
> I prefer to leave 3280 as is (with Stefan's proposed change which I do
> support). The special case for checking email address in subject field
is,
> from my understanding, for backward compatibility reasons only for
> situations where the email address didn't appear in the extension. The
> subject field is a DN and should only be required to be checked if
there
> are DN name constraints (except for this backward compatibility issue
> where the exception is made).
> 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Steve Hanna
> Sent: Thursday, May 06, 2004 10:35 AM
> To: Stefan Santesson
> Cc: [email-masked]
> Subject: Re: RFC 3280 bug in name constraints
> 
> 
> I agree. In fact, I don't see why you wouldn't
> apply name constraints to an EmailAddress attribute
> in a subject DN even if there *is* an rfc822Name
> in a subject alternative name. I suggest that
> the text be revised to say:
> 
>     An rfc822 name constraint MUST be applied to an
>     attribute of type EmailAddress in the subject
>     distinguished name.
> 
> However, I'm willing to back down on this if
> people feel it's too strict. My concern is that
> a certificate with an email address in the
> subject DN prohibited by name constraints will
> be allowed because it also contains a permissible
> email address in the subject alternative name.
> I suspect many applications will not understand
> this and will accept the email address in the
> subject DN. In fact, RFC 2632 and its successor
> don't contain any warning about this.
> 
> Thanks,
> 
> Steve
> 
> Stefan Santesson wrote:
> > If someone is keeping record of bugs for future update of RFC 3280 I
> > have a small one to file about name constraints.
> >
> >
> >
> > In section 4.2.1.11, starting at bottom of page 38:
> >
> >
> >
> >    When rfc822 names are constrained, but the
> >
> >    certificate does not include a subject alternative name, the
rfc822
> >
> >    name constraint MUST be applied to the attribute of type
> > EmailAddress
> >
> >    in the subject distinguished name.
> >
> >
> >
> > Suppose/suggest that the intended meaning is:
> >
> >
> >
> >    When rfc822 names are constrained, but the certificate does not
> >
> >    include an rfc822Name in a subject alternative name extension,
the
> > rfc822
> >
> >    name constraint MUST be applied to the attribute of type
> > EmailAddress
> >
> >    in the subject distinguished name.
> >
> >
> >
> >
> >
> > Rationale:
> >
> > Why would the constraint NOT apply to EmailAddress just because
there
> > is
> > a SubjAltName extension with e.g. just some unrelated other name
> > component present?
> >
> >
> >
> > /Stefan
> >
> >
> >

---

From: Sharon Boeyen <[email-masked]>
Date: Thu, 6 May 2004 14:42:25 -0400

Apparently some could not read the message I sent earlier, so here is a
resend. 

I prefer to leave 3280 as is (with Stefan's proposed change which I do
support). The special case for checking email address in subject field is,
from my understanding, for backward compatibility reasons only for
situations where the email address didn't appear in the extension. The
subject field is a DN and should only be required to be checked if there are
DN name constraints (except for this backward compatibility issue where the
exception is made).

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Steve Hanna
Sent: Thursday, May 06, 2004 10:35 AM
To: Stefan Santesson
Cc: [email-masked]
Subject: Re: RFC 3280 bug in name constraints

Thanks,

Steve

Stefan Santesson wrote:
>    certificate does not include a subject alternative name, the rfc822
> 
>    include an rfc822Name in a subject alternative name extension, the 
> rfc822
> 
> Why would the constraint NOT apply to EmailAddress just because there 
> is