Subject: Re: DN comparison

From: "Tom Gindin" <[email-masked]>
Date: Thu, 27 Jun 2002 08:00:27 -0400

David:

      Corresponding's normal English meaning is not "in the same order as"
but either "in agreement or conformity with" or "similar or analogous to".
Neither of these meanings is notably closer to "in the same order as" than
to "having the same structure".  While I know that X.500 databases are
tree-structured and so RDN order is crucial to finding entries in them, I
do not think that matching certificate subjects based on an order-dependent
rule is more useful than doing so on a structure-dependent rule (i.e. one
which considers that the order of distinct attribute types such as L and O
is irrelevant).  Nobody else has thought that this wording was particularly
clear, even though it appears in an X.500 standard and X.500 implies a tree
structure.

            Tom Gindin

David Chadwick <[email-masked]>@mail.imc.org on 06/26/2002
07:19:38 PM

Sent by:    [email-masked]

To:    Laurence Lundblade <[email-masked]>
cc:    [email-masked]
Subject:    Re: DN comparison

Sorry for being late in on this, but here's my two penneth.

Laurence Lundblade wrote:
>
> What I want to know is how to compare DN's (subject with issuer). I found
> all the stuff about the string processing in 2459 and am happy to see
> that's reasonably dealt with. What I can't find is whether the order of
> RDN's or the order of the parts of the RDN's matter or not. Also I
haven't
> been able to determine if the grouping of parts in RDN's matter or not.
>
> To be specific, which of these are the same in these DN's?
>   1) (O=fish-tacos, OU=fish, OU=halibut), (CO=mexico,ST=baja)

Illegal DN. YOu are not allowed to have the same attribute type twice in
an RDN

>   2) (O=fish-tacos, OU=fish), (OU=halibut), (CO=mexico), (ST=baja)
>   3) (OU=halibut,O=fish-tacos, OU=fish) (ST=baja,CO=mexico)

Illegal DN

>   4) (CO=mexico), (ST=baja), (OU=halibut), (O=fish-tacos, OU=fish)
>
> RDN's are in (). I would think/hope they're all the same.

Sorry. None of them are the same. The reason is that ordering is
important, just as in DNS names.

Also, to clear up the confusion over the word "corresponding". Once you
know that RDN ordering is important within a DN (a DN is a SEQUENCE of
RDNs), then the meaning of corresponding also becomes clear. It has the
normal English meaning that the nth RDN in one DN corresponds with the
nth RDN in another DN. Its that simple.

David

>From reading the
> source, it looks like OpenSSL doesn't care about the grouping of RDN's,
but
> does care about the order.
>
> And more of a standard question, how should I have found the answer to
this
> question? From my current perspective it seems an addition to RFC-3280
> would be helpful.
>
> LL

--
*****************************************************************

David W. Chadwick, BSc PhD
Professor of Information Systems Security
IS Institute, University of Salford, Salford M5 4WT
Tel: +44 161 295 5351  Fax +44 01484 532930
Mobile: +44 77 96 44 7184
Email: [email-masked]
Home Page:  http://www.salford.ac.uk/its024/chadwick.htm
Research Projects: http://sec.isi.salford.ac.uk
Understanding X.500:  http://www.salford.ac.uk/its024/X500.htm
X.500/LDAP Seminars: http://www.salford.ac.uk/its024/seminars.htm
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************

---

From: David Chadwick <[email-masked]>
Date: Thu, 27 Jun 2002 15:34:38 +0100

> but either "in agreement or conformity with" or "similar or analogous to".

Or "matching" as well in my dictionary. I would have thought that to
match something you would have to be in the same order. 1 3 5 does not
match 5 3 1 does it?

> is irrelevant). 

This is where we have another semantic drift. Stucture rules in X.500
are the part of the schema that determine the ordering of RDNs in a DN.
So the structure of a DN and the ordering of RDNs in a DN are
essentially the same thing.

Thus the ordering of L and O attribute types is almost always relevant
in a DN, since a DN is a SEQUENCE of RDNs, which implies ordering. The
only exception is if they are in the same RDN (which comprises a SET of
attribute types, in which case no order exists). 

> Nobody else has thought that this wording was particularly

I have never had a problem with the wording, probably because I helped
to write it. You often need someone not intimately involved with a
standard to be able to pick up its ambiguities and lack of clarity. So
if you can suggest some alternative wording I will take it to the next
X.500 in September for consideration.

regards

David