Subject: Encoding of "dc" in DNs

From: Volker Hammer <[email-masked]>
Date: Thu, 13 Apr 2000 18:05:05 +0200

Hi,

we use the "dc"-Attribute (domain component) to build distinguished names in multinational enterprises.

We need to decide how the "dc"-attribute should be encoded in implementations of the subject distinguished name and issuer dn within certificates as well as for X.500 directory information tree distinguished names. RFC2247 (X.500 OID DomainComponent) tells "IA5 string". Some CA products use "printableString", which is in accordance with recommendation of "DirectoryString" in X.500 ff. But the latter is only a recommendation and not enforced, so IA5 string seems to be correct.

Questions:

* Will interop problems in clients arise when using "the other" encoding (client expects IA5 but find printableString and vice versa)

* Products using printableString: will this be corrected in accordance to RFC2247?

* Other recommendations from the list?

Thanks in advance,
Volker Hammer.
--------------------------------------------------------
Dr.-Ing. Volker Hammer
Security Consultant

Secorvo Security Consulting GmbH
Albert-Nestler-Strasse 9, D-76131 Karlsruhe

Tel. +49 721 6105-458, Fax +49 721 6105-455
E-Mail [email-masked], http://www.secorvo.de
--------------------------------------------------------
PGP-Fingerprint    3C9C AD64 AC6B 64CC  FA6B AE8D 2A5D 462D

---

From: Juergen Brauckmann <[email-masked]>
Date: Fri, 14 Apr 2000 14:03:31 +0200

At 18:05 13.04.00 +0200, Volker Hammer wrote:
>We need to decide how the "dc"-attribute should be encoded in
implementations of the subject distinguished name and issuer dn within
certificates as well as for X.500 directory information tree distinguished
names. RFC2247 (X.500 OID DomainComponent) tells "IA5 string". Some CA
products use "printableString", which is in accordance with recommendation
of "DirectoryString" in X.500 ff. But the latter is only a recommendation
and not enforced, so IA5 string seems to be correct.

DC is defined as type "IA5String" in RFC2247. 

"DirectoryString" is an own type which is used in components of DNs. But
not all DN-Components need to be of type DirectoryString. domainComponent
is *not* of type DirectoryString, but of type IA5String, so it is
definitely an error to encode a DC as a PrintableString.

>* Will interop problems in clients arise when using "the other" encoding
(client expects IA5 but find 
>printableString and vice versa)

That depends, of course... . 

Regards,
   Juergen Brauckmann
-- 
Juergen Brauckmann             Tel.:  040 / 8080 26 311
TC TrustCenter GmbH            Fax.:  040 / 8080 26 126
Sonninstraße 24-28   	    mailto:[email-masked]
20097 Hamburg 		    http://www.trustcenter.de