Subject: LDAP issues in rfc3280bis

From: Kurt Zeilenga <[email-masked]>
Date: Wed, 14 Feb 2007 11:54:48 -0800

I have reviewed draft-ietf-pkix-rfc3280bis-07 for LDAP-related issues,
in particular those around the use of the binary encoding option,
and find the following issues, all relatively minor.

In Section 2.1, references to X.500 and RFC 4510 should
be added, respectively for the terms "X.500 Directory" and "LDAP".
The term LDAP should also be spelled out here (first use in body).

In Section 4.2.1.13, in the paragraph starting with "If the
DistributionPointName contains", the sentence starting with
A reference to RFC 4516 should be provided for "LDAP scheme".
Also, in this sentence, the term "distinguishedName" field
appears to refer to the <dn> field of the LDAP URI,
the term "attribute" to a <attrdesc> field, and "host name"
to the <host> field.   For clarity, it might be better to
say:
	When the LDAP URI scheme [RFC4516] is used, the URI
	MUST contain a <dn> field containing the distinguished
	name of the entry holding the CRL, MUST contain an
	<attrdesc> field containing the name of the attribute
	holding the CRL, and SHOULD contain a <host>.  For
	instance, <ldap://ldap.example.com/cn=exmplCA,
	dc=exmaple,dc=com?certificateRevocationList;binary>.

It may be appropriate to add:
	Where the attribute holding the CRL, typically
	certificateRevocationList or authorityRevocationList
	[RFC4523] requires transfer using ;binary, the <attrdesc>
	field MUST include the binary encoding option, ;binary,
	as discussed in RFC 4522 [RFC4522].

And then to clarify the no host field text:
	Omitting the host name (e.g., <ldap:///cn=example% 
20CA,dc=example,dc=com?
    authorityRevocationList;binary>) has the effect of relying on  
whatever
	a priori knowledge the client might have to contact an appropriate
	server.

Note that I have used angle brackets to clearly indicate the start and
end of the URI.  Angle brackets are reserved in the LDAP URI syntax for
this purpose.

I suggest similar changes be made to sections 4.2.2.1 and 5.2
materials discussing use of LDAP URIs.

-- Kurt