Subject: Where to store SRV based names

From: David Chadwick <[email-masked]>
Date: Thu, 11 Aug 2005 10:25:00 +0100

As a result of my previous message and the various replies to it, it 
seems like the arguments against using the subjectDirectoryAttributes 
extension to store the attribute are

i) we only have a hammer, so the extension has to be a nail (i.e. we 
only support subjectAltNames (and not SDA) so it has to go there), and

ii) since attributes can be anything, we dont want to use them to store 
this attribute, since attributes are a catch all.

I dont actually find either arguement technically convincing, although I 
do find i) pragmatically convincing. (But if we were to extend this 
argument PKIX could have been stillborn, because by using this argument 
we could have said ten years ago that few people were supporting 
certificate extensions so lets not use any of them :-)

However, I do have a solution to offer as follows. Assume that n.n.n is 
the OID assigned to the subjectAltNames extension. The we define the 
following attribute using this OID

srvName ATTRIBUTE	::=	{
WITH SYNTAX		PrintableString (SIZE (1..128))
EQUALITY MATCHING RULE		caseIgnoreMatch
ID		n.n.n }

By doing this we ensure:
i) the extension will be carried in the subjectAltNames extension
ii) the syntax and matching rules for the srv string are fully and 
compactly defined
iii) If anyone also wanted to store the string in LDAP as an attribute 
they could do so using the above definition.

regards

David

-- 

*****************************************************************
David W. Chadwick, BSc PhD
Professor of Information Systems Security
The Computing Laboratory, University of Kent, Canterbury, CT2 7NF
Tel: +44 1227 82 3221
Fax +44 1227 762 811
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html
Research Web site: http://sec.cs.kent.ac.uk
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************

---

From: Tom Gindin <[email-masked]>
Date: Tue, 16 Aug 2005 20:30:26 -0400

David:

        We shouldn't use the OID assigned to the subjectAltName extension. 
 Instead we should assign a new OID, to be assigned to an OTHER-NAME.  We 
also can't use PrintableString with Stefan's syntax, because 
PrintableString doesn't include underscore and the SRV key normally 
contains underscores.  So what is the right string type: IA5String, 
VisibleString (a tighter fit than IA5String, but less familiar), or 
UTF8String (internationalizable)?
        I agree with the general approach of defining a syntax which can 
be used either within GeneralName or in a directory attribute.

                Tom Gindin

David Chadwick <[email-masked]>
Sent by: [email-masked]
08/11/2005 05:25 AM
 
        To:     PKIX <[email-masked]>
        cc: 
        Subject:        Where to store SRV based names

srvName ATTRIBUTE                ::=             {

By doing this we ensure:

regards

David

--

---

From: David Chadwick <[email-masked]>
Date: Mon, 22 Aug 2005 11:22:05 +0100

Tom Gindin wrote:
>  Instead we should assign a new OID, to be assigned to an OTHER-NAME.

Hi Tom

this is what I intended. Sorry if my last email was not clear enough

   We
> UTF8String (internationalizable)?

It all depends upon what the DNS can store in its SRV RR. IA5string 
would surely work, but maybe internationalised DNS can store UFT8Strings 
as well, which would be better. We need a DNS expert to advise.

> be used either within GeneralName or in a directory attribute.

thanks

David

--