Subject: [pkix] Encoding options for user notice policy qualifiers

From: "David A. Cooper" <[email-masked]>
Date: Fri, 13 Nov 2009 10:52:39 -0500

All,

I'd like to follow up on Tim's presentation of the 5280 Implementation 
Report and the discussion about acceptable encoding methods for the user 
notice policy qualifier.  From the meeting minutes:

      There are two options are to put VisibleString back as a depreciated
      option, or we can just deprecate the qualifier. The document editor
      (David Cooper) will be asked to submit a revised version of 5280,
      that adds back VisibleString as a (deprecated) option. WGLC will be
      initiated as soon as this document is posted. No other changes to 5280
      will be considered, since it is being revised expressly to deal 
with the
      problem noted above, which stands in the way of document
      progression.

The user notice policy qualifier was originally defined in RFC 2459, and 
it allows four encoding options: IA5String, VisibleString, BMPString, 
and UTF8String.  In 5280, the decision was made to restrict the set of 
options.

In Section 4.1.2.4 of RFC 5280, the text states that directory 
attributes of type DirectoryString MUST be encoded in either UTF8String 
or PrintableString (with some exceptions).  The idea was that 
PrintableString is just a subset of UTF8String, with the exact same 
encoding for that subset, and so there was no compelling reason to stop 
CAs from using it.  We followed a similar route with userNotice by 
stating that CAs SHOULD use UTF8String, but MAY use IA5String.  As with 
PrintableString, an IA5String may be converted to a UTF8String by simply 
changing the tag.

As Tim noted, in the certificates that I found that included a user 
notice, all used the VisibleString encoding.  However, I need to add two 
things:

1) I have not generated any certificates that include user notices, so I 
have not verified that there are two CA products that can create user 
notices encoded in UTF8String.

2) I have been informed, but have not seen, that some certificates have 
user notices encoded in BMPString:

Nuno Ponte wrote:
> Em 05-03-2009 22:55, David A. Cooper escreveu:
>> I have found several certificates that include a userNotice policy 
>> qualifier with explicitText, but every one of them encodes the 
>> explicitText as VisibleString.
>     I think this is due to the lack of support for UserNotices in 
> UTF8String on older versions of Microsoft Internet Explorer (as far as 
> I remember, IE6 still had this problem).
>     As an example, the EJBCA software (http://www.ejbca.org) has a 
> configuration to choose whether the UserNotice is encoded in 
> UTF8String or BMPString.
>

While I can see the benefit in not including BMPString as an option, in 
order to push vendors towards UTF8String, I think VisibleString should 
be added back in as an option that is not deprecated.  In fact, if there 
is a strong desire to limit the number of choices, I would suggest 
adding VisibleString as an option and removing IA5String as an option, 
since VisibleString is also simply a subset of UTF8String, but a more 
sensible subset than IA5String.

X.680 defines VisibleString and IA5String as:

VisibleString:  6 + SPACE
IA5String:      1, 6 + SPACE + DELETE

1 (http://www.itscj.ipsj.or.jp/ISO-IR/001.pdf) and 6 
(http://www.itscj.ipsj.or.jp/ISO-IR/006.pdf) refer to tables of 
characters from ISO 10646-1.  So, VisibleString consists of the 
characters from Table 6 (http://www.itscj.ipsj.or.jp/ISO-IR/006.pdf) 
plus the SPACE character and IA5String consists of the characters from 
VisibleString plus the DELETE character and the characters from Table 1 
(http://www.itscj.ipsj.or.jp/ISO-IR/001.pdf).

While Table 6 consists of the "ASCII Graphic character set", Table 1 
consists of "The set of control characters of the ISO 646".  So, 
VisibleString is simply IA5String minus the control characters, which I 
would guess should not appear in user notice strings.

Again, a string that is encoded in either IA5String or VisibleString may 
be converted into the same string encoded in UTF8String by simply 
changing the tag from 22 (IA5String) or 26 (VisibleString) to 12 
(UTF8String).  So, any client implementation that can process user 
notices encoded in UTF8String should easily be able to process user 
notices encoded in either IA5String or VisibleString.

So, I see no reason to say that IA5String is acceptable, while 
VisibleString is permitted but deprecated.  So, let's either allow three 
options (UTF8String, IA5String, and VisibleString) or if the number of 
options needs to be limited to two, then make the two options be 
UTF8String and VisibleString.

Dave