Subject: Re: [lamps] New Liaison Statement, "Liaison statement to IETF on RFC 5280 attribute length limitations"

From: Russ Housley <[email-masked]>
Date: Tue, 1 Feb 2022 10:41:43 -0500

Here is the proposed formal response to the ETSI Liaison Statement, adding the discussion about rfc3280bis in 2007.  Thanks to Ryan for digging it up.  Please review and offer improvements. if needed.

Russ

= = = = = = 

The LAMPS WG has considered your request to remove the mandatory upper bounds constraints on naming attributes.  The discussion is available on the mail list archive [1].  It is worth noting that this same topic was previously discussed in the PKIX WG in 2007 [2], 2015 [3], and 2017 [4].  In all three discussions, the outcome was the same.  There is not consensus for removal of the upper-bound size limits on naming attributes in RFC 5280. 

[1] https://mailarchive.ietf.org/arch/msg/spasm/Ab_sKt_ImC9nNNTU6Lci5Ux4fjY/ <https://mailarchive.ietf.org/arch/msg/spasm/Ab_sKt_ImC9nNNTU6Lci5Ux4fjY/>
[2] https://mailarchive.ietf.org/arch/msg/pkix/vlYSadaLgdY7R2LYIeBA923fYhs/
[3] https://mailarchive.ietf.org/arch/msg/pkix/3Rg8ChXgvcmvSlM10ECDI7c2Dik/ <https://mailarchive.ietf.org/arch/msg/pkix/3Rg8ChXgvcmvSlM10ECDI7c2Dik/>
[4] https://mailarchive.ietf.org/arch/msg/pkix/nWgnNZHh2w2l-WfbHKozpm2IWcQ/ <https://mailarchive.ietf.org/arch/msg/pkix/nWgnNZHh2w2l-WfbHKozpm2IWcQ/>

> On Jan 11, 2022, at 5:47 PM, Liaison Statement Management Tool <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Title: Liaison statement to IETF on RFC 5280 attribute length limitations
> Submission Date: 2022-01-11
> URL of the IETF Web page: https://datatracker.ietf.org/liaison/1773/ <https://datatracker.ietf.org/liaison/1773/>
> 
> From: Russ Housley <[email-masked] <mailto:[email-masked]>>
> To: Russ Housley <[email-masked] <mailto:[email-masked]>>,Tim Hollebeek <[email-masked] <mailto:[email-masked]>>
> Cc: Tim Hollebeek <[email-masked] <mailto:[email-masked]>>,Russ Housley <[email-masked] <mailto:[email-masked]>>,Benjamin Kaduk <[email-masked] <mailto:[email-masked]>>,Roman Danyliw <[email-masked] <mailto:[email-masked]>>,Limited Additional Mechanisms for PKIX and SMIME Discussion List <[email-masked] <mailto:[email-masked]>>
> Response Contacts: 
> Technical Contacts: 
> Purpose: For information
> 
> Body: ETSI brings to the attention of IETF that the limitation of the length of certain attributes indicated in RFC 5280 Annex A.1 mandatory "Upper bounds" which make the document inappropriate for current use.
> RFC 5280 is widely referenced as a requirement or recommendation in many internationally recognised PKI specifications including:
> 
> -	CA/Browser Forum guidelines for the Issuance And Management of Extended Validation Certificates
> -	ETSI EN 319 412-x  Electronic Signatures and Infrastructures (ESI); Certificate Profiles
> 
> These specifications include requirements for certain attributes to be based upon full names as held in official records / registers.  In particular, this applies to registered names held in X.509 attributes:
> -	subject: organizationName
> -	subject: givenName
> -	subject: surname
> 
> and can also apply to:
> -	subject: commonName
> -	subject: pseudonym
> -	subject: organizationalUnitName
> 
> In a number of cases the full name as held in official records / registers is larger than the than the limit stated in RFC 5280 Annex A.1 under "Upper bounds".  For example, an analysis of a sample of 5000 from 2 million registrations of Legal Entity Identifiers, as made available through the Global Legal Entity Identifier Foundation (see https://search.gleif.org/#/search/ <https://search.gleif.org/#/search/>), showed 110 cases where the identifier is more than 64 characters).  Thus, roughly 2% of organization identifiers officially registered exceed the mandatory limit indicated in RFC 5280 stated as follows:
> 
> --  specifications of Upper Bounds MUST be regarded as mandatory
> --  from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
> --  Upper Bounds
> :
> :
> ub-organization-name INTEGER ::= 64
> 
> Similar problems have been reported with the use of European national registers for personal and organization names.
> 
> Since 11/2008 the attributes used in certificate subject names, as defined in X.520, have been changed from being size limited to an " UnboundedDirectoryString".  It is considered that modern PKI implementations support the X.520 "UnboundedDirectoryString" for name attributes.
> 
> ETSI strongly urges IETF to supersede RFC 5280 with a specification including limits based on X.520, instead of X.411 Annex B which has not been updated since 1999.  Until then ETSI is having to give specific exclusions to its references to RFC 5280 which is causing unnecessary concern with the adoption of PKIs based on IETF RFCs.
> Attachments:
> 
>    ESI(21)000140r1_Liaison_statement_to_IETF_on_RFC_5280_attribute_length_limit.docx
>    https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2022-01-11-esti-tc-esi-lamps-liaison-statement-to-ietf-on-rfc-5280-attribute-length-limitations-attachment-1.docx <https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2022-01-11-esti-tc-esi-lamps-liaison-statement-to-ietf-on-rfc-5280-attribute-length-limitations-attachment-1.docx>
> 
>

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 1 Feb 2022 15:45:51 +0000

*   Here is the proposed formal response to the ETSI Liaison Statement, adding the discussion about rfc3280bis in 2007.  Thanks to Ryan for digging it up.  Please review and offer improvements. if needed.

Ship it.

---

From: Ryan Sleevi <[email-masked]>
Date: Tue, 1 Feb 2022 10:49:23 -0500

+1

On Tue, Feb 1, 2022 at 10:46 AM Salz, Rich <rsalz=
[email-masked]> wrote:

>
>    - Here is the proposed formal response to the ETSI Liaison Statement,
>    adding the discussion about rfc3280bis in 2007.  Thanks to Ryan for digging
>    it up.  Please review and offer improvements. if needed.
>
>
>
> Ship it.
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 1 Feb 2022 21:06:25 +0100

Yes,

I agree that this is the obvious outcome of the discussion.

And thanks Ryan and others for digging up the old debates of this issue.
I was at least happy to find that I have been consistent in my opinion
over the years :)

Finally, I just posted a question on TLS on this issue. The intention is
NOT to re-open this debate, which I think is closed. It is simply to
satisfy my desire for knowledge (Would removing size limits break TLS?).

I will not be actively pursuing a particular path in ETSI but, I could
keep you posted on the outcome. I have already told them that this
request will be denied. It seems from the early discussion there that a
likely outcome is that ETSI will stop being a strict profile of RFC 5280
and move to become selectively compliant.

Thanks for the discussion.

/Stefan

Den 2022-02-01 kl. 16:49, skrev Ryan Sleevi:
> +1
>
> On Tue, Feb 1, 2022 at 10:46 AM Salz, Rich
> <rsalz=[email-masked]> wrote:
>
>       * Here is the proposed formal response to the ETSI Liaison
>         Statement, adding the discussion about rfc3280bis in 2007. 
>         Thanks to Ryan for digging it up.  Please review and offer
>         improvements. if needed.
>
>      
>
>     Ship it.
>

---

From: Russ Housley <[email-masked]>
Date: Tue, 1 Feb 2022 18:38:21 -0500

RE: https://datatracker.ietf.org/liaison/1773/

The LAMPS WG has considered the request from ETSI to remove the upper bounds constraints on naming attributes in RFC 5280.  The discussion is available on the mail list archive [1].  It is worth noting that this same topic was previously discussed in the PKIX WG in 2007 [2], 2015 [3], and 2017 [4].  In all four discussions, the outcome was the same.  There is not consensus for removal of the upper-bound size limits on naming attributes in RFC 5280. 

[1] https://mailarchive.ietf.org/arch/msg/spasm/Ab_sKt_ImC9nNNTU6Lci5Ux4fjY/
[2] https://mailarchive.ietf.org/arch/msg/pkix/vlYSadaLgdY7R2LYIeBA923fYhs/
[3] https://mailarchive.ietf.org/arch/msg/pkix/3Rg8ChXgvcmvSlM10ECDI7c2Dik/
[4] https://mailarchive.ietf.org/arch/msg/pkix/nWgnNZHh2w2l-WfbHKozpm2IWcQ/

> On Jan 11, 2022, at 5:47 PM, Liaison Statement Management Tool <[email-masked]> wrote:
> 
> URL of the IETF Web page: https://datatracker.ietf.org/liaison/1773/
> 
> From: Russ Housley <[email-masked]>
> To: Russ Housley <[email-masked]>,Tim Hollebeek <[email-masked]>
> Cc: Tim Hollebeek <[email-masked]>,Russ Housley <[email-masked]>,Benjamin Kaduk <[email-masked]>,Roman Danyliw <[email-masked]>,Limited Additional Mechanisms for PKIX and SMIME Discussion List <[email-masked]>
> Response Contacts: 
> Technical Contacts: 
> Purpose: For information
> 
> In a number of cases the full name as held in official records / registers is larger than the than the limit stated in RFC 5280 Annex A.1 under "Upper bounds".  For example, an analysis of a sample of 5000 from 2 million registrations of Legal Entity Identifiers, as made available through the Global Legal Entity Identifier Foundation (see https://search.gleif.org/#/search/), showed 110 cases where the identifier is more than 64 characters).  Thus, roughly 2% of organization identifiers officially registered exceed the mandatory limit indicated in RFC 5280 stated as follows:
> 
>    https://www.ietf.org/lib/dt/documents/LIAISON/liaison-2022-01-11-esti-tc-esi-lamps-liaison-statement-to-ietf-on-rfc-5280-attribute-length-limitations-attachment-1.docx
>