FW: New Liaison Statement, "Liaison to IETF on the removal of upper bound in X.509"

[Stefan Santesson <stefans@xxxxxxxxxxxxx>]

Forwarding a liaison e-mail from ISO/ITU.

This seems like a very reasonable change to me, but please review and provide feedback.


Stefan Santesson
Senior Program Manager
Windows Security, Standards


-----Original Message-----
From: Xiaoya Yang [mailto:tsbsg17@xxxxxxx]
Sent: den 5 oktober 2007 14:19
To: Russ Housley; Stefan Santesson
Cc: Herbert Bertine; tsbsg17@xxxxxxx; era@xxxxxxxxxx; Xiaoya YANG; tsbsg17@xxxxxxx; era@xxxxxxxxxx
Subject: New Liaison Statement, "Liaison to IETF on the removal of upper bound in X.509"


Title: Liaison to IETF on the removal of upper bound in X.509
Submission Date: 2007-10-05
URL of the IETF Web page: https://datatracker.ietf.org/public/liaison_detail.cgi?detail_id=376
Please reply by 2008-03-01

From: Xiaoya Yang(ITU-T SG 17) <tsbsg17@xxxxxxx>
To: IETF/PKIX(Russ Housley <housley@xxxxxxxxxxxx>, Stefan Santesson <stefans@xxxxxxxxxxxxx>)
Cc: Herbert Bertine <hbertine@xxxxxxxxxxxxxxxxxx>
<tsbsg17@xxxxxxx>
<era@xxxxxxxxxx>
Reponse Contact: Xiaoya YANG <xiaoya.yang@xxxxxxx>
<tsbsg17@xxxxxxx>
Technical Contact: <era@xxxxxxxxxx>
Purpose: For action
Body: In relation to resolve a Defect Report, it appears to majority within the X.500 community to remove hard-coded length restriction whenever a DirectoryString is used.
In response to developer demand in the early days of the standard X.520 contained a list of maximum lengths for a variety of string types, e.g., organizationalName.  The values specified were non-normative.  However, some implementers treated the values as normative.  This has caused interoperability problem with implementations.
We plan to remove the upper bounds specified in the standard. In particular we intend to eliminate the Upper Bounds for DirectoryString.
The proposal does not change the definition of DirectoryString, but attribute definitions will look slightly different.  As an example, street address may

streetAddress{INTEGER:maxSize}  ATTRIBUTE  ::=  {
        WITH SYNTAX                                     DirectoryString {maxSize}
        EQUALITY MATCHING RULE                  caseIgnoreMatch
        SUBSTRINGS MATCHING RULE                caseIgnoreSubstringsMatch
        ID                                                      id-at-streetAddress }
That means that at implementation time, the upper limit may be added if wanted. Otherwise an unlimited string may be assumed.
The proposal will not change the bits on the wire and we believe this is in line with what the PXIX group is already doing.  We are forwarding this liaison to ensure that the PKIX group has no problem with this proposal.
Please confirm that you have no objection to our removal of upper bounds.
Attachment(s):
No document has been attached