Re: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber attribute

[Denis Pinkas <[e-mail]>]

James,

> Thanks David.
> 
>>cn="John Doe" , o="Acme Ltd" serialNumber="DUNS554433", c=US
> 
> Denis's "problem" DN does not need to be solved.  The DN does NOT contain a PI for the subject so the CA will not include a PI extension saying it does.  End of story.
> 
> Russ's "problem" DN does not need to be solved.  As David notes, an attribute type is not allowed to appear more than once in an RDN.
> 
> I still suggest using my original text changes.

Your original text was: "when identifierValue is absent the
deepest serialNumber value is used". I would guess that you mean:
"when identifierValue is absent, the value contained in the
serialNumber of the deepest RDN SHALL be used."

I would propose instead to re-use my text, modified by David,
with an additional modification for the item 2. This leads to:

1 - if there are one or more RDNs containing a serialNumber
     attribute (alone or accompanied by other attributes), then
     the value contained in the serialNumber of the deepest
     such RDN SHALL be used as the identifierValue.

2 - otherwise, the Permanent Identifier definition is invalid
     and the Permanent Identifier SHALL not be used.

Denis



> -----Original Message-----
> From: David P. Kemp [mailto:[e-mail]]
> Sent: Thursday, 22 July 2004 5:58 AM
> To: Denis Pinkas
> Cc: Russ Housley; Manger, James H; [e-mail]
> Subject: Re: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber
> attribute
> 
> 
> Denis,
> 
> Your two conditions below are logical but unnecessarily
> restrictive.
> 
> Consider James' original (correct) example:
> 
> [1] cn="John Doe" serialNumber=12345, o="Acme Ltd"
>     serialNumber="DUNS 554433", c=US
> 
> and a modification (poorly-structured, but legal) that uses
> only single-valued RDNs:
> 
> [2] cn="John Doe", serialNumber=12345, o="Acme Ltd",
>    serialNumber="DUNS 554433", c=US
> 
> and your example:
> 
> [3] cn="John Doe", o="Acme Ltd", serialNumber="DUNS 554433", c=US
> 
> 
> I do not believe it is necessary to prohibit [2] in order to
> prevent [3].  Instead, if the SAN identifierValue is absent:
> 
> 1 - if there are one or more RDNs containing a serialNumber
>      attribute (alone or accompanied by other attributes), then
>      the value contained in the serialNumber of the deepest
>      such RDN shall be used as the identifierValue.
> 
> 2 - otherwise, the CA is in error.
> 
> 
> X.501 (02/2001) section 9.3, which appears to be normative,
> not informative, prohibits a given attribute type from
> appearing more than once in the same RDN.  The origin of
> Russ' comments regarding the possibility of multiple
> serialNumber attributes in a single RDN is unclear.
> 
> Dave
> 
> 
> 
> Denis Pinkas wrote:
> 
> 
>>1 - if there is one serialNumber attribute alone in a RDN (i.e. no
>>    other attribute is present in that RDN), then *there shall
>>    only be one such RDN and* the value contained in the
>>    serialNumber attribute shall be used as the identifierValue;
>>
>>2 - if there is no serialNumber attribute alone in a RDN, then the
>>    deepest RDN shall include a *single* serialNumber attribute
>>    and the value contained in that serialNumber shall be used
>>    as the identifierValue.
>>
>>Denis
> 
> 
> 
>