Subject: [pkix] RFC 5280 Questionnaire for PKI clients

From: "David A. Cooper" <[email-masked]>
Date: Mon, 31 Aug 2009 12:19:31 -0400

All,

I am renewing my effort 
(http://www.ietf.org/proceedings/74/slides/pkix-3.pdf) to prepare a 
document to justify advancing the PKIX Certificate and CRL Profile (RFC 
5280) to Draft Standard status.  Based on 
draft-dusseault-impl-reports-04, I feel comfortable that I have found 
sufficient evidence of interoperable implementations of most features in 
RFC 5280 by obtaining certificates and CRLs from TLS protected web 
sites, signed emails, and the U.S. Federal PKI and as a result of 
testing path validation software against PKITS 
(http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html) 
along with some additional testing.

While I was able to demonstrate the existence of multiple 
implementations for almost all of the PKI client-related features of RFC 
5280, I have not yet identified any clients that implement the new 
processing rules for internationalized names in Section 7 of RFC 5280.  
So, in order to ensure the completeness of the implementation report, I 
am employing the questionnaire approach to obtain information about PKI 
client implementations of Section 7.

If you have a PKI client product, you can help me out by answering the 
questions below.  Please let me know the name and version of the product 
for which the information is being provided.

Thanks in advance,

Dave
--------------------------------------------

(1) Does the client compare naming attributes
    of type DirectoryString by performing
    a caseIgnoreMatch after performing
    the LDAP StringPrep as specified in
    Section 7.1 of RFC 5280?

(2) Does the client perform syntax-based normalization
    on URIs as specified in Section 7.4 of RFC 5280?

(3) Does the client perform scheme-based normalization
    on URIs as specified in Section 7.4 of RFC 5280 for
    the following schemes:

    * ldap?
    * http?
    * https?
    * ftp?