Subject: Re: order of name attributes in certificates, suggestion for 3280 bis

From: Tom Gindin <[email-masked]>
Date: Mon, 10 Apr 2006 08:26:11 -0400

Comments below, marked as [TG].

                Tom Gindin

Peter Sylvester <[email-masked]>
04/07/2006 11:59 AM
 
        To:     Tom Gindin/Watson/IBM@IBMUS
        cc:     [email-masked]
        Subject:        Re: order of name attributes in certificates, 
suggestion for 3280 bis

Tom Gindin wrote:
>         Peter:
>
>         Section 4.1.2.4 describes the "Name" field as hierarchical, in 
the
> context of the Issuer (first text sentence on p. 19 of RFC 3280). 
Section
> 4.1.2.6 for Subject points back to 4.1.2.4.  What else should be added? 
It
> wouldn't hurt, I suppose, if we pointed out that the order of the
> attributes is highest-order first, and thus that country always precedes
> state, organization always precedes OU, and common name, serial number 
or
> the personal name fields normally follow any of those four attributes 
(or
> locality) which are present.
>
Where is said "in the context of the CA?"

[TG]    Section 4.1.2.4 is the definition of the Issuer field, not the 
Subject.  There is no reference to the DN being hierarchical in the 
Subject's section, just in the Issuer's section.

Yes,  such kind of  hint  is what I am thinking about. The term 
hierarchical
is a bit easy to overlook. A reference to X.521 may be also useful.
where is said "in the context of the CA?"

A 'Name' type describes a name composed of  attributes.  The rdnSequence 
is
a hierarchy where the first component as the highest in the hierarchy. 
X.521
suggest a particular structure of names in the context of the directory, a
Directory Information Tree structure. When using the same attributes as
in the
suggested structure, it is RECOMMENDED to follow the rules in X.521
in order to respect the semantics of each attribute. Not following the 
rules
may make it impossible to the extensions for permitted and excluded
subtrees
(not only in cross certification environments).

As an example, when a name has a country attribute, this occurs in the
first element in the sequence.  Having a CommonName as the first
element may probably only useful for the Dalai Lama (with only this 
attribut
in the Name).

[TG]    My own view on this is found in my message of Thursday night. 
Further, I am not sure that Country always precedes Organization in actual 
DN's, although it usually does.

Users should be aware that different tools may not should the rdnSequence
in the same order. Since displaying a certificate shows (in general) the
Issuer and Subject, an inverted order in one of the names is easy to 
detect.

Some of this could also be in an appendix similar to the ASN.1 notes.

>         I wonder if putting this in 3280-bis would accomplish much,
> though.  Do you think that the absence of a note about the order of
> attributes in the Issuer definition of RFC 3280 is a major reason for 
CA's
> creating DN's with arbitrarily ordered attributes?  This is especially
> doubtful since RFC 3280 C.2 and C.3 currently give sample certificates
> with both the Issuer and Subject having attributes in an appropriate 
order
> (C, O, OU, and CN in the Subject) although the text description gives 
them
> in reverse order.  3280-bis uses only DC and CN, but again CN is last.
>
The major error that I see all the time is that the order is inverse.
since it is not clear
in which order things are displayed by tools, or better it is not clear
depending
of the cultural whether 'first displayed' is highest or lowest.

An example of how to drive on the right side doesn't mean that it is
forbidden
to drive on the wrong side.

[TG]    Again, my message of Thursday night goes into this.  I define the 
high order section as "a group of consecutive RDN's beginning with the 
DN's first RDN".  If that explanation is formalized, it can be stated that 
"first RDN" means first in the DER encoding of the DN.

>                 Tom Gindin
>
>
>
>
>
>
> Peter Sylvester <[email-masked]>
> Sent by: [email-masked]
> 04/04/2006 12:58 PM
>
>         To:     [email-masked]
>         cc:
>         Subject:        order of name attributes in certificates,
> suggestion for 3280 bis
>
>
> Hi,
>
> It seems that many people regularily put RDNs in in the wrong direction
> or sometimes almost arbitrary order into certificate DNs.
>
> One of the reasons are different textual representaion that are used by
> different tools and protocol (like LDAP)
>
> When reading 3280 it is not obvious that people are aware the 
hierarchical
> nature of the name, the only indication may be the specification of the
> permitted/excluded name tree.
>
> Would it be possible to include a reminder to 3280bis in some way?
>
> Peter
>
>
> --
> To verify the signature, see http://edelpki.edelweb.fr/
> Cela vous permet de charger le certificat de l'autorité;
> die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.
>
>
>
>
> #### smime.p7s has been removed from this note on April 04, 2006 by Tom
> Gindin
>
>
>
>
>
>

--
To verify the signature, see http://edelpki.edelweb.fr/
Cela vous permet de charger le certificat de l'autorité;
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

#### smime.p7s has been removed from this note on April 07, 2006 by Tom 
Gindin

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 11 Apr 2006 11:46:55 +0200

> Subject's section, just in the Issuer's section.

"Name", i.e. a DN is hierarchical.
The subject name field is defined as the X.501 type Name.

How do you define "permitted subtree" the Name is not hierarchical?

> DN's, although it usually does.
I only said that if it follows the suggested DIT structure ...

Even with ibm.com worldwide and  "us" below this "us"
is not a country, it is an organsiational unit.

> "first RDN" means first in the DER encoding of the DN.
There is no agreed way for a textual order of DNs.
(Your email address is not written as  dc=com;dc=ibm;dc=us;??=tgindin)

There are the two possibilities of displaying the sequence, and you have 
others
that use the attribut types differently.