Subject: Re: [certid] Comments on draft-saintandre-tls-server-id-check-03

From: =JeffH <[email-masked]>
Date: Wed, 14 Apr 2010 08:32:27 -0700

Thanks for bringing this up Nelson, it's certainly subtle-but-important aspects 
of this spec. Peter and I've been editing the spec and are working on 
addressing these items.

fwiw..

 > The various standards for translating a DER encoded Name into
 > a string call for the RDNs to be ordered, left to right, from most specific
 > to most general, the reverse of the order in which they appear in the
 > DER encoded certificate.

AFAICT, there is only one clear non-implementation-specific specification for a 
X.500/LDAP DN string representation, and that's (now) RFC4514 (obsoletes 2253, 
which obsoleted 1779, which obsoleted 1485). Is there a DN string rep specified 
anywhere in the ISO specs (I can't find one)?

IIRC, quipu (a historical ISODE X.500 implementation) had its own DN string 
rep, which was left-to-right, matching the ordering of the DER encoded form in 
the certificate.

thanks,

=JeffH

---

From: Nelson B Bolyard <[email-masked]>
Date: Tue, 20 Apr 2010 20:06:38 -0700

On 2010/04/14 08:32 PDT, =JeffH wrote:
> Thanks for bringing this up Nelson, it's certainly subtle-but-important
> aspects of this spec. Peter and I've been editing the spec and are
> working on addressing these items.
> 
> fwiw..
> 
>> The various standards for translating a DER encoded Name into a string
>> call for the RDNs to be ordered, left to right, from most specific to
>> most general, the reverse of the order in which they appear in the DER
>> encoded certificate.
> 
> AFAICT, there is only one clear non-implementation-specific
> specification for a X.500/LDAP DN string representation, and that's
> (now) RFC4514 (obsoletes 2253, which obsoleted 1779, which obsoleted
> 1485).

Yes, that sequence of RFC is the set of "various standards" to which I was
referring.

> Is there a DN string rep specified anywhere in the ISO specs (I can't
> find one)?

I'm not aware of one.  But people often assume that the tools they most
frequently use implement "the standards".  Increasingly I find that people
assume that certain popular free tools ARE "the standard" for these things.
:( and there are numerous free tools at the moment that don't
follow the above-cited RFCs in this respect.

> IIRC, quipu (a historical ISODE X.500 implementation) had its own DN
> string rep, which was left-to-right, matching the ordering of the DER
> encoded form in the certificate.