Re: New Liaison Statement, "Liaison to IETF on the removal of upper bound in X.509"

[Russ Housley <[e-mail]>]

In the 1988 blue book, the Upper Bounds annex and module were normative. It also limited common name to 64 bytes.

The next edition (1993) contained: "This annex does not form an integral part of this Recommendation | International Standard."

The third edition (1997) contains the same text as the second edition. And, ub-name has the value of 32768.

The fourth edition (2000) is the same as the third. However, ub-name hase a different value; it is set to 128.

The PKIX WG seems to be using the 1997 upper bound numbers, but they are normative in RFC 2459 and RFC 3280.

Personally, I missed the subtle change from normative to informative.  I suspect many others did too.  If the PKIX WG to make them informative too, then it will have to be done *right now*.  The 3280bis document has started the approval process.  According to the Data Tracker, Sam Hartman is doing his AD Review right now.

Russ

At 09:44 AM 10/5/2007, Russ Housley wrote:

Title: Liaison to IETF on the removal of upper bound in X.509
Submission Date: 2007-10-05
URL of the IETF Web page: https://datatracker.ietf.org/public/liaison_detail.cgi?detail_id=376" rel="nofollow"> https://datatracker.ietf.org/public/liaison_detail.cgi?detail_id=376
Please reply by 2008-03-01

From: Xiaoya Yang(ITU-T SG 17) <[e-mail]>
To: IETF/PKIX(Russ Housley <[e-mail]>, Stefan Santesson <[e-mail]>)
Cc: Herbert Bertine <[e-mail]>
<[e-mail]>
<[e-mail]>
Reponse Contact: Xiaoya YANG <[e-mail]>
<[e-mail]>
Technical Contact: <[e-mail]>
Purpose: For action
Body: In relation to resolve a Defect Report, it appears to majority within the X.500 community to remove hard-coded length restriction whenever a DirectoryString is used.
In response to developer demand in the early days of the standard X.520 contained a list of maximum lengths for a variety of string types, e.g., organizationalName.  The values specified were non-normative.  However, some implementers treated the values as normative.  This has caused interoperability problem with implementations.
We plan to remove the upper bounds specified in the standard. In particular we intend to eliminate the Upper Bounds for DirectoryString.
The proposal does not change the definition of DirectoryString, but attribute definitions will look slightly different.  As an example, street address may

streetAddress{INTEGER:maxSize}  ATTRIBUTE  ::=  {
        WITH SYNTAX                                         DirectoryString {maxSize}
        EQUALITY MATCHING RULE                    caseIgnoreMatch
        SUBSTRINGS MATCHING RULE                  caseIgnoreSubstringsMatch
        ID                                                              id-at-streetAddress }
That means that at implementation time, the upper limit may be added if wanted. Otherwise an unlimited string may be assumed.
The proposal will not change the bits on the wire and we believe this is in line with what the PXIX group is already doing.  We are forwarding this liaison to ensure that the PKIX group has no problem with this proposal.
Please confirm that you have no objection to our removal of upper bounds.
Attachment(s):
No document has been attached