Re: Long Name Requirements

[Stefan Santesson <[e-mail]>]

While RFC 5280 has retained upper bounds for backwards compatibility I would
not expect products on the market to enforce them. Microsoft for one does
not.

If you are applying this in a controlled environment, you could simply test
with the OS versions and applications that are being used to see if there is
any problem.

However, eventhough your description is brief, it strikes me whether it
would be more suitable to define a subjectAltName for your "long" name form
instead of throwing it into a subject attribute. It appears to me as you are
building a unique alternative identifier through this long string rather
than an attribute of a relative distinguished name structure.

/stefan


On 2/23/09 7:28 PM, "Kemp, David P." <[e-mail]> wrote:

> 
> Ersin,
> 
> While X.509 permits unlimited-length strings in the Subject field, it
> may be worth considering usability before making a decision to exercise
> that freedom.
> 
> From a practical perspective, applications may handle long names with
> varying degrees of grace - some may have hard-coded upper bounds based
> on 5280 and will refuse to accept longer strings; others may have user
> interface layouts based on length assumptions and may truncate or wrap
> for display purposes without rejecting the certificate.  If you buy or
> develop applications designed to handle long strings, then no problem as
> long as every application that touches your certificates can handle them
> properly.
> 
> From a theoretical perspective, title (regardless of length) probably
> doesn't belong in the Subject field.  The Subject name is an identifier
> that tells "who" the certificate applies to.  Other information about
> the user, such as height, weight, date of birth, fax number, or
> title/role/position within the organization can be included in
> certificates but are not semantically identifiers.  Contact information
> can go either way - at the office a fax number is probably shared but
> you have a private voice line that uniquely refers to you, while at home
> the voice line may be shared with the wife and kids but the only fax
> machine is in your home office.  If your purpose is to issue a "role
> certificate" to a position without regard to who occupies the position,
> then title is an identifier and does belong in the Subject name.  But in
> most cases, title is an attribute of the user, not part of the user's
> name.  The X.520 title attribute is most appropriately placed in the
> Subject Directory Attributes extension, with the same implementation
> considerations as above.
> 
> As Eric says, defining a new attribute type is not necessary because it
> would be at least as difficult to get applications to support a new type
> as it would be to support the new syntax of the existing attribute.
> Hopefully RFC 5280 bis will follow X.509's lead, making upper bounds
> minima that implementations MUST support, not maxima that
> implementations MUST NOT exceed.
> 
> I'm sure someone will point out that there is precedent for putting
> almost anything you want in the Subject name, including certificate
> policy statements and mpeg videos of cats.  But don't be persuaded that
> everything that is syntactically valid is necessarily wise.
> 
> 
> 
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]]
> On Behalf Of Erik Andersen
> Sent: Monday, February 23, 2009 9:57 AM
> To: [e-mail]; [e-mail]
> Subject: RE: Long Name Requirements
> 
> 
> Hi Ersin,
> 
> In the latest edition of X.509, we removed the length restrictions on
> attribute types. The PKIX group did not follow suit, but retained the
> length
> restriction. A field of 500 characters will not comply with RFC 5280,
> but it
> will comply with the X.509 itself, and that is what is important.
> 
> You can find links to the lasted documents on
> http://www.x500standard.com/index.php?n=Extension.Ed6.
> 
> You do not need to define own attribute types.
> 
> Erik Andersen
> Andersen's L-Service
> Elsevej 48, DK-3500 Vaerloese
> Denmark
> Mobile: [phone]
> email: [e-mail]
> www.x500.eu
> www.x500standard.com
>  
> 
> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]]
> On
> Behalf Of [e-mail]
> Sent: 23. februar 2009 14:42
> To: [e-mail]
> Subject: Long Name Requirements
> 
> 
> Hi,
> 
> I have read through the PKIX mailing list archives to find a method for
> using name components longer than 64 characters in the Subject field of
> an
> X.509 v3 certificate. Unfortunately I could not find a solution which
> satisfies RFC 5280 (3280) by using standard CN, Title, O or OU
> components.
> 
> Now I plan to use a custom attribute-value pair in the Subject field. Is
> there any widely used OID for really long names in the Subject field? I
> need to put full company titles, up to 500 characters long, in the
> Subject
> field.
> 
> Regards,
> 
> Ersin
> 
> 
> 
>