Re: [xacml-comment] X500 Name Match unclarity

[David Chadwick <d.w.chadwick@kent.ac.uk>]

Could it be that terminal sequence actually means "final RDN"

regards

David


Florian Huonder wrote:
> Hi all,
> 
>  
> 
> I am talking about the X500 name match function 
> urn:oasis:names:tc:xacml:1.0:function:x500Name-match (XACML 2.0 Spec).
> 
> There in the description the term “terminal sequence” is used but this 
> does not exist in any X500 specifications.
> 
> Therefore it is undefined and therefore it leaves room for interpretation.
> 
>  
> 
> Possibility 1:
> 
> True is returned in case when all elements of the X500Name in the 
> request are contained in the X500Name in the Policy, in any order. The 
> number of elements must not match but the number of elements in the 
> request must be at least as much as in the Policy.
> 
>  
> 
> Possibility 2:
> 
> The term “terminal sequence” can be interpreted as “the last element of 
> the X500 names must match and not all elements.
> 
>  
> 
> Could anybody tell me how this x500Name-match function must be implemented?
> 
>  
> 
> Regards,
> 
> Florian
> 

-- 

Aung San Suu Kyi

Burma’s democracy leader, Aung San Suu Kyi, is unwell and is being 
denied proper medical attention by the Burmese regime. Her doctor was 
arrested on Thursday 7 May 2009 without explanation. Aung San has 
currently spent over 13 YEARS under arrest.

Please sign the petition now and help free Burma’s Political Prisoners: 
http://www.burmacampaign.org.uk/fbppn.htm


*****************************************************************
David W. Chadwick, BSc PhD
Professor of Information Systems Security
The Computing Laboratory, University of Kent, Canterbury, CT2 7NF
Skype Name: davidwchadwick
Tel: +44 1227 82 3221
Fax +44 1227 762 811
Mobile: +44 77 96 44 7184
Email: D.W.Chadwick@kent.ac.uk
Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html
Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************