Re: Profiling CN usage

[Chris Tzu <[e-mail]>]

Peter,

Peter Gutmann wrote:
> 
> >This will become a problem as more and more protocols take advantage of
> >X.509 (or whatever the 'public key signed by someone else' standard will
> >be). For example, there is no standard for what should be in the CN for
> >LDAP, etc.
> 
> I suspect I've probably mentioned this here before, I've collected what
> information I could find on X.509 usage, including some comments on the use
> and format of DNs/CNs, in http://www.cs.auckland.ac.nz/~pgut001/x509guide.txt.
> This isn't any attempt at defining a standard profile, but merely "here's what
> others are doing, and some suggestions on what you should try to do" (along
> with traps to watch out for).
> 
> Peter.

This is a very interesting area which is currently being worked
in the IETF IDS Group. In particular, they are progressing toward
a naming plan which applies to user names and CA names in X.509 
certificates.

The proposed naming plan take advantage of the domain name which
everyone is already familiared with, and very scaleable.

See
ftp://ds.internic.net/internet-drafts/draft-ietf-ids-dirnaming-01.txt

BTW, the guide you produced was excellent reading.


Chris Tzu
AT&T
Directory and Security Services