Subject: Re: rfc 3280bis

From: Peter Sylvester <[email-masked]>
Date: Wed, 23 Jan 2008 17:13:31 +0100

>
> SCVP uses wild characters for validationNames, not for names included in certificates.
> Until I have clue to understand where "three additional lines" (which ones ?) would be included 
> in RFC 3280bis, I disagree.
>   
SCVP seems ambiguous in this sense.

Names may contain the wildcard character * which is considered to
   match any single domain name component.  That is, *.a.com matches
   foo.a.com but not bar.foo.a.com.

To me it is not clear what "Names" refer to because in the previous sentences
'name' is used for both cases. 

The name validation algorithm allows the client to specify one or
   more subject names that MUST appear in the end certificate in
   addition to the requirements specified for the basic validation
   algorithm.  The name validation algorithm allows the client to supply
   an application identifier and a name to the server.  The application
   identifier defines the name matching rules to use in comparing the
   name supplied in the request with the names in the certificate.

I have no problem not allowing wildcards in subjectAltName. 

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

---

From: "Denis Pinkas" <[email-masked]>
Date: Wed, 23 Jan 2008 16:24:33 +0100

>I agree to the change proposals before this one.

>I would not oppose the wildcard amendment either IF it turns out to be non-controversial to include the change.
>"*" is indeed used in commercial certificates today, so it definitely represents a real need.

We should be very careful with "last minute" change proposals.

Denis

>Stefan Santesson
>Senior Program Manager
>Windows Security, Standards
>
>
>> -----Original Message-----
>> From: [email-masked] [mailto:owner-ietf-
>> [email-masked]] On Behalf Of Peter Sylvester
>> Sent: den 16 januari 2008 13:46
>> To: Stephen Kent
>> Cc: David A. Cooper; pkix
>> Subject: Re: rfc 3280bis
>>
>> And what about '*.foo.net'?  I cite from SCVP.
>>
>>    If the nameCompAlgId supplied in the request is id-kp-serverAuth
>>    [PKIX-1 <http://tools.ietf.org/html/draft-ietf-pkix-scvp-32#ref-
>> PKIX-1>], then GeneralNames supplied in the request MUST be a
>>    dNSName, and the matching rules to be used are defined in [PKIX-1
>> <http://tools.ietf.org/html/draft-ietf-pkix-scvp-32#ref-PKIX-1>].
>>
>>    If a subjectAltName extension is present and includes one or more
>>    names of type dNSName, a match in any one of the set is considered
>>    acceptable.  If the subjectAltName extension is omitted, or does not
>>    include any names of type dNSName, the (most specific) Common Name
>>    field in the Subject field of the certificate MUST be used.
>>
>> I think that something like the three lines above should be included in
>> 3280bis?
>>
>>
>> Stephen Kent wrote:
>> >
>> > David,
>> >
>> > Then let's make this late minute fix, and keep Sam informed.
>> >
>> > Steve
>> >
>> >
>>
>>
>> --

Regards,

Denis Pinkas