Subject: RFC3039/X.500 naming question

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 14 Jan 2003 07:53:24 +0100

Hi,

A colleague of mine claims that the DN 

   "CN=Marion Anderson, serialNumber=nnnnnnnnnnnn, C=SE"

denotes a Swedish citizen according to ISO/ITU standards.
This makes the DN string globally unique as as it would be a 
"violation" to use the same naming scheme for expressing
lets say "members" of some kind of organization "associated" to Sweden.

I claim that this is a "convention" (maybe even "good practice")
but that this statement at least has no support in PKIX RFCs.
RFC3039 which should be close to this issue is BTW absolutely
mum about what "C" actually means.

Thoughts?

cheers.
Anders Rundgren

---

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 14 Jan 2003 10:49:26 +0100

Anders,

Comments in line;

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Anders Rundgren
> Sent: Tuesday, January 14, 2003 7:53 AM
> To: [email-masked]
> Subject: RFC3039/X.500 naming question
>
>
>
> Hi,
>

What ISO/ITU Standard would that be?
My guess is that your colleague is wrong. There is at least nothing in RFC
3280 or RFC 3039 that support that statement.

> lets say "members" of some kind of organization "associated" to Sweden.

Again that is not necessarily true. A RP can not assume globally uniqueness
just based on the information you supply here. RFC 3039 provide a mechanism
where you could define semantics fro these attributes so that the RP could
have this information and knowledge about the name uniqueness.

> mum about what "C" actually means.

Actually not.

RFC 3039 section 3.1.2 says:

   The countryName attribute value specifies a general context in which
   other attributes are to be understood.  The country attribute does
   not necessarily indicate the subject's country of citizenship or
   country of residence, nor does it have to indicate the country of
   issuance.

   Note: Many X.500 implementations require the presence of countryName
   in the DIT.  In cases where the subject name, as specified in the
   subject field, specifies a public X.500 directory entry, the
   countryName attribute SHOULD always be present.

/Stefan

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 14 Jan 2003 11:16:54 +0100

Thanx Stefan,
some minor "return-data".

>What ISO/ITU Standard would that be?

The ones that are the foundation for X.500, that's all I know.

>3280 or RFC 3039 that support that statement.

So I have understood it as well.  But he claims that you must FIRST
read the ISO/ITU-stuff which is NORMATIVE and then see what's
fits with the PKIX RFCs.  I find this both awkard and unrealistic.

<snip>

>   country of residence, nor does it have to indicate the country of

Well, "mum" was an exaggeration of mine, but it is pretty clear that "C"
do not carry huge semantic weight in RFC3039.  Which IMO is perfectly OK.

<snip>

Anders

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Tue, 14 Jan 2003 16:28:00 +0100 (CET)

In message <012901c2bbb6$11d292d0$0500a8c0@arport> on Tue, 14 Jan 2003 11:16:54 +0100, "Anders Rundgren" <[email-masked]> said:

anders.rundgren> >> A colleague of mine claims that the DN
anders.rundgren> >>
anders.rundgren> >>    "CN=Marion Anderson, serialNumber=nnnnnnnnnnnn, C=SE"
anders.rundgren> >>
anders.rundgren> >> denotes a Swedish citizen according to ISO/ITU standards.
anders.rundgren> 
anders.rundgren> >What ISO/ITU Standard would that be?
anders.rundgren> 
anders.rundgren> The ones that are the foundation for X.500, that's all I know.

I think your colleague should say exactly what he or she means, or we
can discuss endlessly and in loops...  You can't really throw
something like "the ISO/ITU Standards" and assume that everyone knows
what you're talking about.

I'm assuming that what's meant is X.520, which mentions a number of
attribute types.  All those used in the DN above exist according to
that document.

Note that the ISO/ITU standards (at least those I have a copy of) say
nothing about swedish citizen, so the fact that swedish citizen get a
DN like the above is outside the scope of ISO/ITU and has been
documented somewhere else.  So the question "What ISO/ITU Standard
would that be?" is pretty well founded.

anders.rundgren> >My guess is that your colleague is wrong. There is
anders.rundgren> >at least nothing in RFC 3280 or RFC 3039 that
anders.rundgren> >support that statement.
anders.rundgren> 
anders.rundgren> So I have understood it as well.  But he claims that
anders.rundgren> you must FIRST read the ISO/ITU-stuff which is
anders.rundgren> NORMATIVE and then see what's fits with the PKIX
anders.rundgren> RFCs.  I find this both awkard and unrealistic.

That actually depends entirely on your base of operation.  PKIX
document the use of certificates and PKI for the Internet, so if you
base your operation on the Internet, the PKIX documents would be
normative.  You would however have to find all the missing pieces in
the ISO/ITU documents :-/.

At least that's how I understand things.  Am I alone in this belief?

(from a personal point of view: when I started playing with PKI, I did
start with the ISO/ITU documents I could get hold of, and then went on
to the RFCs.  However, since my business is based on the Internet, I
base my work on the letter of the RFCs first)

-- 
Richard Levitte     | http://richard.levitte.org/ | Spannv. 38, I
Levitte Programming | http://www.lp.se/           | S-168 35 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"

---

From: "Stefan Santesson" <[email-masked]>
Date: Wed, 15 Jan 2003 11:28:54 +0100

> From: Anders Rundgren [mailto:[email-masked]]
> Sent: Tuesday, January 14, 2003 11:17 AM
> To: Stefan Santesson; [email-masked]
> Subject: Re: RFC3039/X.500 naming question
>
>
> Thanx Stefan,

Where? To my knowledge there is no such thing. You need to dig that out and
show me.

> fits with the PKIX RFCs.  I find this both awkard and unrealistic.

But first he must show where ISO/ITU contradict RFC 3039. I think I dare to
promise that there is no such thing.
We where in liaison with the ITU folks when writing RFC 3039 and we even
managed to get a change in X.520 definition of SerialNumber in order for
X.509 to support the RFC 3039 use of the attribute.

> do not carry huge semantic weight in RFC3039.  Which IMO is perfectly OK.

It is as it must be. If you want to define country of residence and
citizenship, there are ways in RFC 3039 to do so.
Look in subject directory attributes section.

/Stefan