RE: Long Name Requirements

["Kemp, David P." <[e-mail]>]

Ersin,

While X.509 permits unlimited-length strings in the Subject field, it
may be worth considering usability before making a decision to exercise
that freedom.

>From a practical perspective, applications may handle long names with
varying degrees of grace - some may have hard-coded upper bounds based
on 5280 and will refuse to accept longer strings; others may have user
interface layouts based on length assumptions and may truncate or wrap
for display purposes without rejecting the certificate.  If you buy or
develop applications designed to handle long strings, then no problem as
long as every application that touches your certificates can handle them
properly.

>From a theoretical perspective, title (regardless of length) probably
doesn't belong in the Subject field.  The Subject name is an identifier
that tells "who" the certificate applies to.  Other information about
the user, such as height, weight, date of birth, fax number, or
title/role/position within the organization can be included in
certificates but are not semantically identifiers.  Contact information
can go either way - at the office a fax number is probably shared but
you have a private voice line that uniquely refers to you, while at home
the voice line may be shared with the wife and kids but the only fax
machine is in your home office.  If your purpose is to issue a "role
certificate" to a position without regard to who occupies the position,
then title is an identifier and does belong in the Subject name.  But in
most cases, title is an attribute of the user, not part of the user's
name.  The X.520 title attribute is most appropriately placed in the
Subject Directory Attributes extension, with the same implementation
considerations as above.  

As Eric says, defining a new attribute type is not necessary because it
would be at least as difficult to get applications to support a new type
as it would be to support the new syntax of the existing attribute.
Hopefully RFC 5280 bis will follow X.509's lead, making upper bounds
minima that implementations MUST support, not maxima that
implementations MUST NOT exceed.

I'm sure someone will point out that there is precedent for putting
almost anything you want in the Subject name, including certificate
policy statements and mpeg videos of cats.  But don't be persuaded that
everything that is syntactically valid is necessarily wise.



-----Original Message-----
From: [e-mail] [mailto:[e-mail]]
On Behalf Of Erik Andersen
Sent: Monday, February 23, 2009 9:57 AM
To: [e-mail]; [e-mail]
Subject: RE: Long Name Requirements


Hi Ersin,

In the latest edition of X.509, we removed the length restrictions on
attribute types. The PKIX group did not follow suit, but retained the
length
restriction. A field of 500 characters will not comply with RFC 5280,
but it
will comply with the X.509 itself, and that is what is important.

You can find links to the lasted documents on
http://www.x500standard.com/index.php?n=Extension.Ed6.

You do not need to define own attribute types.

Erik Andersen
Andersen's L-Service
Elsevej 48, DK-3500 Vaerloese
Denmark
Mobile: [phone]
email: [e-mail]
www.x500.eu
www.x500standard.com
 

-----Original Message-----
From: [e-mail] [mailto:[e-mail]]
On
Behalf Of [e-mail]
Sent: 23. februar 2009 14:42
To: [e-mail]
Subject: Long Name Requirements


Hi,

I have read through the PKIX mailing list archives to find a method for
using name components longer than 64 characters in the Subject field of
an
X.509 v3 certificate. Unfortunately I could not find a solution which
satisfies RFC 5280 (3280) by using standard CN, Title, O or OU
components.

Now I plan to use a custom attribute-value pair in the Subject field. Is
there any widely used OID for really long names in the Subject field? I
need to put full company titles, up to 500 characters long, in the
Subject
field.

Regards,

Ersin