Subject: RE: Where to store SRV based names

From: "Stefan Santesson" <[email-masked]>
Date: Mon, 22 Aug 2005 15:55:32 +0100

Originally I suggested IA5String but many voices suggested UTF-8, so
that is what will go into next draft unless someone has a reason to
suggest otherwise.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security
 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of David Chadwick
> Sent: den 22 augusti 2005 12:22
> To: Tom Gindin
> Cc: PKIX
> Subject: Re: Where to store SRV based names
> 
> 
> 
> 
> Tom Gindin wrote:
> >         David:
> >
> >         We shouldn't use the OID assigned to the subjectAltName
> extension.
> >  Instead we should assign a new OID, to be assigned to an
OTHER-NAME.
> 
> 
> Hi Tom
> 
> this is what I intended. Sorry if my last email was not clear enough
> 
> 
>    We
> > also can't use PrintableString with Stefan's syntax, because
> > PrintableString doesn't include underscore and the SRV key normally
> > contains underscores.  So what is the right string type: IA5String,
> > VisibleString (a tighter fit than IA5String, but less familiar), or
> > UTF8String (internationalizable)?
> 
> It all depends upon what the DNS can store in its SRV RR. IA5string
> would surely work, but maybe internationalised DNS can store
UFT8Strings
> as well, which would be better. We need a DNS expert to advise.
> 
> >         I agree with the general approach of defining a syntax which
can
> > be used either within GeneralName or in a directory attribute.
> 
> thanks
> 
> David
> 
> >
> >                 Tom Gindin
> >
> >
> >
> >
> >
> >
> > David Chadwick <[email-masked]>
> > Sent by: [email-masked]
> > 08/11/2005 05:25 AM
> >
> >         To:     PKIX <[email-masked]>
> >         cc:
> >         Subject:        Where to store SRV based names
> >
> >
> >
> > As a result of my previous message and the various replies to it, it
> > seems like the arguments against using the
subjectDirectoryAttributes
> > extension to store the attribute are
> >
> > i) we only have a hammer, so the extension has to be a nail (i.e. we
> > only support subjectAltNames (and not SDA) so it has to go there),
and
> >
> > ii) since attributes can be anything, we dont want to use them to
store
> > this attribute, since attributes are a catch all.
> >
> > I dont actually find either arguement technically convincing,
although I
> > do find i) pragmatically convincing. (But if we were to extend this
> > argument PKIX could have been stillborn, because by using this
argument
> > we could have said ten years ago that few people were supporting
> > certificate extensions so lets not use any of them :-)
> >
> > However, I do have a solution to offer as follows. Assume that n.n.n
is
> > the OID assigned to the subjectAltNames extension. The we define the
> > following attribute using this OID
> >
> > srvName ATTRIBUTE                ::=             {
> > WITH SYNTAX                              PrintableString (SIZE
(1..128))
> > EQUALITY MATCHING RULE                           caseIgnoreMatch
> > ID                               n.n.n }
> >
> > By doing this we ensure:
> > i) the extension will be carried in the subjectAltNames extension
> > ii) the syntax and matching rules for the srv string are fully and
> > compactly defined
> > iii) If anyone also wanted to store the string in LDAP as an
attribute
> > they could do so using the above definition.
> >
> > regards
> >
> > David
> >
> >
> 
> --
> 
> *****************************************************************
> David W. Chadwick, BSc PhD
> Professor of Information Systems Security
> The Computing Laboratory, University of Kent, Canterbury, CT2 7NF
> Tel: +44 1227 82 3221
> Fax +44 1227 762 811
> Mobile: +44 77 96 44 7184
> Email: [email-masked]
> Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html
> Research Web site: http://sec.cs.kent.ac.uk
> Entrust key validation string: MLJ9-DU5T-HV8J
> PGP Key ID is 0xBC238DE5
> 
> *****************************************************************

---

From: Russ Housley <[email-masked]>
Date: Mon, 22 Aug 2005 18:57:52 -0400

I went to the DNS tutorial at IETF63. One of the points that was made was 
that the DNS itself did not limit the character set.  It stores an octet 
string.

I suggest that we ask the DNS Directorate for advice.  Perhaps you can work 
with Steve Bellovin, who is a member of the DNS Directorate to carry the 
question forward.  I suspect you will have to help him formulate a concise 
question.

Russ