Subject: SubjectAltName comparison question.

From: "Julien Stern" <[email-masked]>
Date: Mon, 13 Jan 2003 15:50:17 +0100

Hi all,

sorry if this is a multi-faq, I checked the archives but could not
find it.

In short the question is: are DN comparisons somewhat inconsistent with
comparisons on equivalent fields in SubjectAltName and IssuerAltName
in RFC3280 ?

More precisely, RFC3280 says in 4.1.2.4:

(b) attribute values in types other than PrintableString are case
sensitive (this permits matching of attribute values as binary objects);

So, because email addresses and domain components are represented as
Ia5Strings, I understand that they should be entirely matched in
a case sensitive manner.

Now, the same RFC in 4.2.1.7 defines matching rules for 
rfc822Name (fully case insensitive according to the RFC, and already
questionned on the list by Steve Hanna, if I remember correctly),
and for dNSName (fully case insensitive).

So, if one choose to put an email attribute or a domain components
attribute in a DN inside a GeneralName, the matching will not be the same
as if the email or the domain components are put in an rfc822Name
or a dNSName inside a GeneralName ?

Now, Pkcs9Email is a legacy attribute, so this might not be a big deal,
but domainComponent is not, and it is explicitely stated in 4.2.1.7 that

"a DNS name MAY be represented in the subject field using the
domainComponent attribute as described in section 4.1.2.4."

So, it seems to me that we have two legal representations for DNS names,
which are not equivalent, as they should be matched differently.

--
Julien Stern
Cryptolog International