Subject: [pkix] personal data attributes were corrected in pkix-oid.asn, fix your software

From: Sean Leonard <[email-masked]>
Date: Thu, 31 Oct 2013 21:53:19 -0700

Hi PKIX:

I worked with Russ and Paul to correct a problem in pkix-oid.asn, 
located here:
http://www.imc.org/ietf-pkix/pkix-oid.asn

The section "personal data attributes" now properly reads:
-- personal data attributes

id-pda-dateOfBirth             OBJECT IDENTIFIER ::= { id-pda 1 }
id-pda-placeOfBirth            OBJECT IDENTIFIER ::= { id-pda 2 }
id-pda-gender                  OBJECT IDENTIFIER ::= { id-pda 3 }
id-pda-countryOfCitizenship    OBJECT IDENTIFIER ::= { id-pda 4 }
id-pda-countryOfResidence      OBJECT IDENTIFIER ::= { id-pda 5 }

Previously (such as prior to this week), the list incorrectly read:

id-pda-dateOfBirth             OBJECT IDENTIFIER ::= { id-pda 1 }
id-pda-placeOfBirth            OBJECT IDENTIFIER ::= { id-pda 2 }
id-pda-pseudonym               OBJECT IDENTIFIER ::= { id-pda 3 }
id-pda-gender                  OBJECT IDENTIFIER ::= { id-pda 4 }
id-pda-countryOfCitizenship    OBJECT IDENTIFIER ::= { id-pda 5 }
id-pda-countryOfResidence      OBJECT IDENTIFIER ::= { id-pda 6 }

A pseudonym attribute in the arc was suggested in early drafts of PKCS 
#9, but was abandoned; the proper attribute is id-at-pseudonym 
(2.5.4.65) in the X.500 arc.

While most software properly used the ASN.1 modules in the relevant 
standards, some software may have relied on this incorrect list, 
resulting in an off-by-one problem. Notably, the certificate viewer that 
ships with Mac OS X used the old list. If an Apple developer is reading 
this, please fix that.

Thank you,

Sean