Subject: Very Basic DN question

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 3 Jan 2001 15:33:15 +0100

Sorry for bringing a very basic question to the table but I could not find
this information anywhere.

DN1    CN=John Doe, C=US, SN=6767
DN2    CN=John Doe + C=US + SN=6767

The latter is what *some* (not all!) certificate viewers show when the SET contains
multiple items.

Q: Does the former indicate a tree (with CN at the top?) , while the latter indicate
that all elements belong to the same level?  We RDBMS-oriented developers
do seldom utilize this information but it is always nice to know. :-)

/anders

---

From: "Darren Harter" <[email-masked]>
Date: Wed, 3 Jan 2001 14:52:30 -0000

Anders,

The simple answer is yes.

In the first case you have one Distinguished Name (DN) that contains three
Relative Distinguished Names (RDNs) where each RDN has one Attribute Type
and Value (ATV).  If the order of the RDNs in your string representaion is
the same as the order in the RDN's in the ASN.1 encoding, then yes the CN is
the top of the tree.  If they are shown reverse of the ASN.1 encoding (and
some applications do show DNs the other way around), then SN is the top of
the tree.  It all depends on  the directory schema used by your application.

In the second case, you have one DN that has one RDN, where the RDN has
three ATVs; all at the same level in the tree - the top.

Hope this helps,

Darren

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: 03 January 2001 14:33
To: PKIX-List
Subject: Very Basic DN question

The latter is what *some* (not all!) certificate viewers show when the SET
contains
multiple items.

Q: Does the former indicate a tree (with CN at the top?) , while the latter
indicate
that all elements belong to the same level?  We RDBMS-oriented developers
do seldom utilize this information but it is always nice to know. :-)

/anders

---

From: "David A. Cooper" <[email-masked]>
Date: Wed, 03 Jan 2001 10:11:54 -0500

Darren,

I would differ with your interpretation slightly. RFC 2253 (UTF-8 String Representation of Distinguished Names) states that "the output consists of the string encodings of each RelativeDistinguishedName ... starting with the last element of the sequence and moving backwards toward the first." Thus, if DN1 were properly encoded according to RFC 2253, it should be interpreted as a SEQUENCE of 3 RDNs with SN being the first element in the SEQUENCE(i.e., the top of the tree) and CN being the last element (i.e., the the bottom of the tree).

In the case of DN2, the plus sign as a separator indicates that DN2 consists of one multi-valued RDN. Since an RDN is a SET of attribute type and value pairs (as opposed to a SEQUENCE), the elements are unordered (i.e., they are all at the same level).

Dave

---

From: "Darren Harter" <[email-masked]>
Date: Wed, 3 Jan 2001 15:26:24 -0000

Thanks for the RFC2253 quote Dave.

I agree completely.  Unfortunately, in my experience not all applications
conform to it - hence me describing both orderings.

Darren

-----Original Message-----
From: David A. Cooper [mailto:[email-masked]]
Sent: 03 January 2001 15:12
To: 'PKIX-List'
Subject: RE: Very Basic DN question

Darren,

I would differ with your interpretation slightly. RFC 2253 (UTF-8 String
Representation of Distinguished Names) states that "the output consists of
the string encodings of each RelativeDistinguishedName ... starting with the
last element of the sequence and moving backwards toward the first." Thus,
if DN1 were properly encoded according to RFC 2253, it should be interpreted
as a SEQUENCE of 3 RDNs with SN being the first element in the
SEQUENCE(i.e., the top of the tree) and CN being the last element (i.e., the
the bottom of the tree).

In the case of DN2, the plus sign as a separator indicates that DN2 consists
of one multi-valued RDN. Since an RDN is a SET of attribute type and value
pairs (as opposed to a SEQUENCE), the elements are unordered (i.e., they are
all at the same level).

Dave