Subject: RE: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber attribute

From: "Manger, James H" <[email-masked]>
Date: Thu, 22 Jul 2004 10:40:00 +1000

Thanks David.

> cn="John Doe" , o="Acme Ltd" serialNumber="DUNS554433", c=US

Denis's "problem" DN does not need to be solved.  The DN does NOT contain a PI for the subject so the CA will not include a PI extension saying it does.  End of story.

Russ's "problem" DN does not need to be solved.  As David notes, an attribute type is not allowed to appear more than once in an RDN.

I still suggest using my original text changes.

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]]
Sent: Thursday, 22 July 2004 5:58 AM
To: Denis Pinkas
Cc: Russ Housley; Manger, James H; [email-masked]
Subject: Re: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber
attribute

Denis,

Your two conditions below are logical but unnecessarily
restrictive.

Consider James' original (correct) example:

[1] cn="John Doe" serialNumber=12345, o="Acme Ltd"
    serialNumber="DUNS 554433", c=US

and a modification (poorly-structured, but legal) that uses
only single-valued RDNs:

[2] cn="John Doe", serialNumber=12345, o="Acme Ltd",
   serialNumber="DUNS 554433", c=US

and your example:

[3] cn="John Doe", o="Acme Ltd", serialNumber="DUNS 554433", c=US

I do not believe it is necessary to prohibit [2] in order to
prevent [3].  Instead, if the SAN identifierValue is absent:

1 - if there are one or more RDNs containing a serialNumber
     attribute (alone or accompanied by other attributes), then
     the value contained in the serialNumber of the deepest
     such RDN shall be used as the identifierValue.

2 - otherwise, the CA is in error.

X.501 (02/2001) section 9.3, which appears to be normative,
not informative, prohibits a given attribute type from
appearing more than once in the same RDN.  The origin of
Russ' comments regarding the possibility of multiple
serialNumber attributes in a single RDN is unclear.

Dave

Denis Pinkas wrote:

> 
> 1 - if there is one serialNumber attribute alone in a RDN (i.e. no
>     other attribute is present in that RDN), then *there shall
>     only be one such RDN and* the value contained in the
>     serialNumber attribute shall be used as the identifierValue;
> 
> 2 - if there is no serialNumber attribute alone in a RDN, then the
>     deepest RDN shall include a *single* serialNumber attribute
>     and the value contained in that serialNumber shall be used
>     as the identifierValue.
> 
> Denis

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 26 Jul 2004 11:27:46 +0200

James,

> I still suggest using my original text changes.

Your original text was: "when identifierValue is absent the
deepest serialNumber value is used". I would guess that you mean:
"when identifierValue is absent, the value contained in the
serialNumber of the deepest RDN SHALL be used."

I would propose instead to re-use my text, modified by David,
with an additional modification for the item 2. This leads to:

1 - if there are one or more RDNs containing a serialNumber
     attribute (alone or accompanied by other attributes), then
     the value contained in the serialNumber of the deepest
     such RDN SHALL be used as the identifierValue.

2 - otherwise, the Permanent Identifier definition is invalid
     and the Permanent Identifier SHALL not be used.

Denis

---

From: Richard Levitte - VMS Whacker <[email-masked]>
Date: Mon, 26 Jul 2004 12:42:53 +0200 (CEST)

Hey guys,

I've lurked for a while, and have perhaps not entirely followed, so I
appologise in advance for jumping in like this.

I'm curious about the following:

In message <[email-masked]> on Mon, 26 Jul 2004 11:27:46 +0200, Denis Pinkas <[email-masked]> said:

Denis.Pinkas> > Thanks David.
Denis.Pinkas> > 
Denis.Pinkas> >>cn="John Doe" , o="Acme Ltd" serialNumber="DUNS554433", c=US
Denis.Pinkas> 
Denis.Pinkas> I would propose instead to re-use my text, modified by
Denis.Pinkas> David, with an additional modification for the item 2.
Denis.Pinkas> This leads to:
Denis.Pinkas> 
Denis.Pinkas> 1 - if there are one or more RDNs containing a
Denis.Pinkas>      serialNumber attribute (alone or accompanied by
Denis.Pinkas>      other attributes), then the value contained in the
Denis.Pinkas>      serialNumber of the deepest such RDN SHALL be used
Denis.Pinkas>      as the identifierValue. 

What would that mean for a DN like the one quoted above?  Does it mean
that John Doe would get serialNumber="DUNS554433" as PI by default?
What would then happen if J. Random Luser also gets a DN from Acme Ltd,
like this:

  cn="J. Random Luser", o="Acme Ltd" serialNumber="DUNS554422", c=US

Does that mean that J. Random Luser also would get
serialNumber="DUNS554433" as PI by default?

If that's what you mean, then it doesn't feel sane to me.

-----
Please consider sponsoring my work on free software.
See http://www.free.lp.se/sponsoring.html for details.

-- 
Richard Levitte     | http://richard.levitte.org/ | Tunnlandsv. 52
Levitte Programming | http://www.lp.se/           | S-168 36 Bromma
T: +46-708-26 53 44 |                             | SWEDEN
     "Price, performance, quality...  choose the two you like"