Re: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber attribute

[Denis Pinkas <[e-mail]>]

James,

> That is wrong.
> 
> A DN names an object by describing a path to it through a hierarchy of
> other objects.  Each RDN consists of attributes of one of those *other*
> objects.  Only the last RDN has attributes of the actual named object.
> A serialNumber attribute (like any other attribute) can appear multiple
> times -- once for each level of the hierarchy (ie once for each RDN).
> 
> RDN = *Relative* Distinguished Name.
> 
> [Note. No attribute type can appear multiple times within a single RDN.]
> 
> In my sample DN:
> cn="John Doe" serialNumber=12345, o="Acme Ltd" serialNumber="DUNS
> 554433", c=US
> there are 3 objects: a country, a company and a person.  The person only
> has one serialNumber.  The company is an object in its own right so it
> can have its own serialNumber.

OK.

> So please reconsider my suggestion (1) that when identifierValue is
> absent the deepest serialNumber value is used.

I understand what you mean, but the proposed formulation is wrong.

Suppose a certificate with:
cn="John Doe" , o="Acme Ltd" serialNumber="DUNS554433", c=US

then there would be thousands of certificates with the same PI and refering 
to differents persons. :-(

> [Theoretically, the PI draft could require the serialNumber be in the
> deepest RDN.  This would ensure the serialNumber is an attribute of the
> named object, not of some parent object. However, I would not recommend that.
> It is not unusual for DNs (particularly in certificates) to only
> use 1 attribute per RDN, even if some of the attributes all relate to
> the same logical object.]

This remark is correct, but we need a way to prevent the case mentionned above.

There would be two cases to consider:

1 - if there is one serialNumber attribute alone in a RDN (i.e. no
     other attribute is present in that RDN), then the value contained
     in that serialNumber shall be used as the identifierValue;

2 - if there is no serialNumber attribute alone in a RDN, then the
     deepest RDN shall include a serialNumber attribute and the
     value contained in that serialNumber shall be used as the
     identifierValue.

Is this formulation correct ?

Denis

> ----------
> From: Denis Pinkas [mailto:[e-mail]]
> Sent: Wednesday, 21 July 2004 12:01 AM
> 
> Section 5.2.9 from X520 defines the serial Number attribute as follows:
> 
> "The serial Number attribute type specifies an identifier, the serial
> number 
> of an objet."
> 
> The serial Number attribute applies to the object, not to a RDN
> component.
> Thus, unless it is an error, there can't be multiple serial Number 
> attributes in a DN.
>