RE: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber attribute

["Manger, James H" <[e-mail]>]

That is wrong.

A DN names an object by describing a path to it through a hierarchy of
other objects.  Each RDN consists of attributes of one of those *other*
objects.  Only the last RDN has attributes of the actual named object.
A serialNumber attribute (like any other attribute) can appear multiple
times -- once for each level of the hierarchy (ie once for each RDN).

RDN = *Relative* Distinguished Name.

[Note. No attribute type can appear multiple times within a single RDN.]

In my sample DN:
cn="John Doe" serialNumber=12345, o="Acme Ltd" serialNumber="DUNS
554433", c=US
there are 3 objects: a country, a company and a person.  The person only
has one serialNumber.  The company is an object in its own right so it
can have its own serialNumber.

So please reconsider my suggestion (1) that when identifierValue is
absent the deepest serialNumber value is used.

[Theoretically, the PI draft could require the serialNumber be in the
deepest RDN.  This would ensure the serialNumber is an attribute of the
named object, not of some parent object.  However, I would not recommend
that.  It is not unusual for DNs (particularly in certificates) to only
use 1 attribute per RDN, even if some of the attributes all relate to
the same logical object.]


----------
From: Denis Pinkas [mailto:[e-mail]]
Sent: Wednesday, 21 July 2004 12:01 AM

Section 5.2.9 from X520 defines the serial Number attribute as follows:

"The serial Number attribute type specifies an identifier, the serial
number 
of an objet."

The serial Number attribute applies to the object, not to a RDN
component.
Thus, unless it is an error, there can't be multiple serial Number 
attributes in a DN.