Subject: X509.v3 Namespace Extension

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 8 Feb 2002 21:52:23 +0100

List,
A problem in the X509 world is to create a reasonably robust naming scheme
that allows RP software to *safely* distinguish certificates from different CAs,
using subject attributes based on DN, SubjectAltName, private extensions etc.
Essentially the DN has become useless for separating subjects certified by
different CAs as there is no convention for naming subjects that has any major
acceptance.

There is also a problem with separating different subject types using the same
CA cert+key.

Therefore I propose two non-critical extensions to cope with this.

Both are based on using a URI [RFC2396] as a name-space indicator.
As this has been found to be enough to globally separate the truly giant
amount of different XML Schemas currently in preparation, it should
definitely be satisfactory for X509.v3 certificates.

In addition to separating name-spaces, the extension also allows
CAs to use an http URL (a URI) to point to a document/directory
describing the name-space and the associated subject.

The proposed extensions essentially make an X509.v3 certificate
having three dimensions:
- An issuer/trust dimension
- A subject/entity dimension
- A name-space/entity-type dimension

The last dimension is actually already heavily exploited, based on
conventions (usually hard-coding knowledge about the CA and its
issuance), but would with the proposed extensions, become explicit.

If name-spaces are shared between CAs, the CAs SHOULD follow
the same procedures, and subject formats, so that EE-certificates
can be compared at subject level with no false matches.

One version of the extension is CA-cert-based and vouches
for the *next* level of certificates belonging to a set of defined
name-spaces. 

Another version of the extension would vouch for the certificate
itself, telling what name-space the certificate belongs to.  If the
certificates' CA, has a CA-based name-space extension, one of
the CA-declared name-spaces MUST match that of the certificate.
This extension MUST be specified, if the CA-cert has a CA-level
name-space extension, with more than one declared name-space.

Any thoughts on this?

Anders Rundgren