Subject: 3280bis issue: DP name matching between IDP and CRLDP

From: "Wen-Cheng Wang" <[email-masked]>
Date: Wed, 17 Nov 2004 18:36:43 +0800

In CRL processing/validation specified by both RFC 3280
and the X.509 standards, there is a requirement that at least 
 one of names in the distribution point name field (if present)
of the IDP extension (if present) of the CRL must match
one of the names in the distribution point name field of one
distribution point field of the CRLDP extension of the certificate.
Alternative, one of names in the distribution point name field
(if present) of the IDP extension (if present) of the CRL must
match one of the names in the cRLIssuer field of one
distribution point field of the CRLDP extension of the certificate.

However, RFC 3280 did not clearly specify the distribution point
name matching rule. Does two names need to be exactly matched
(binary matched)? Can a Stringprep-based matching (e.g., the text
string matching profile proposed by Paul Hoffman and Steve Hanna)
be used? What about case sensitivibility or whitespace ignorability?

Since they are all of GeneralNames type, they can be in various
name forms. They might be DN, URI,  RFC822 Name, DNS Name,
or IP Address. For URI, they might be http URI, ftp URI, mailto URI,
ldap URI. Different name form might need different matching rules.
Alternative, we might stipulate that "Binary Matching" must be use
for DP name matching between IDP and CRLDP for security reason. 

Wen-Cheng Wang