Subject: RE: C=country; just a convention?

From: Vivian Cancio <[email-masked]>
Date: Mon, 21 May 2001 10:55:15 -0700

Frank Balluffi said:

> As I recall LDAP does transmit the string representation of a 
> Name (e.g., "CN=Steve Kille,O=Isode Limited,C=GB") over the 
> wire in anOCTET STRING (or LDAPString).

It may not work if "stateOrProvinceName" is ever one of the fields
transmitted between vendors. See the discrepancies from the feedback. I have
concluded that there's no specification defining a formal standard for these
short names. Any expected interoperability over the wire must rely on the
OID (which was the intention in the first place?).

I guess the users reading displayed certificates using this terminology must
be clever and deduct based on the information on the right of the "=", or
vendors should provide "legends" defining their use.

Here is one example of discrepancy:
In X.520:
s	stateOrProvinceName

In Peter's list:
sp	stateOrProvinceName
st	streetAddress
s	surname

In RFC 2253
st	stateOrProvinceName

Vivian

> -----Original Message-----
> From: Frank Balluffi [mailto:[email-masked]]
> Sent: Friday, May 18, 2001 6:42 PM
> To: Vivian Cancio
> Cc: [email-masked]
> Subject: RE: C=country; just a convention?
> 
> 
> Vivian Cancio said:
> 
> > I'm assuming that since it doesn't go "on the wire" it is somewhat
> > irrelevant?
> 
> As I recall LDAP does transmit the string representation of a 
> Name (e.g.,
> "CN=Steve Kille,O=Isode Limited,C=GB") over the wire in an 
> OCTET STRING (or
> LDAPString). You can even roll your own AttributeTypeAndValues using
> period-delimited attribute types and hexadecimal attribute values. For
> example
> 
> 1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB [From RFC 2253.]
> 
> Frank
>

---

From: [email-masked] (Terry Hayes)
Date: Mon, 21 May 2001 11:47:03 -0700

I believe the string representation of a Distinguished Name (DN) that we 
are discussing is defined by the LDAP RFCs, not by X.500 or PKIX .  As 
such we should expect that the LDAP RFC would give some indication as to 
the proper form of the attribute type. Looking in RFC 2253, we find the 
following statement:

  "If the AttributeType is in a published table of attribute types 
associated with LDAP [4], then the type name string from that table is 
used, otherwise it is encoded as the dotted-decimal encoding of the 
AttributeType's OBJECT IDENTIFIER."

The reference "LDAP [4]" is for RFC 2252.  However I don't see a table 
of values in that document.  RFC 2252 itself references X.520, so it may 
be intended that attribute type strings from that document should apply.

Terry Hayes