839663 - Add the OID for the 'name' attribute type in X.520

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Wan-Teh Chang]

Attachment: Patch

Someone sent me a certificate whose Subject field contains an
attribute type with the OID 2.5.4.41. Firefox displays the
Subject field as:

  E = [e-mail]
  Object Identifier (2 5 4 41) = testing
  CN = xxx
  OU = xxx
  O = xxx
  L = xxx
  ST = CA
  C = US

The NSS 'pp' command-line tool prints the Subject field as:

        Subject: "E=[e-mail],OID.2.5.4.41=testing,CN=xxx,OU=xxx,
            O=xxx,L=xxx,ST=CA,C=US"

The attached patch enables the 'pp' tool to prints the 'name' attribute.
I believe a PSM patch is necessary to allow the Firefox certificate viewer
to display the 'name' attribute.

Bob, Kaspar: I need your feedback on whether the 'name' attribute should
be added above or below the "strict mode" line in the name2kinds array
in lib/certdb/alg1485.c:

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/certdb/alg1485.c&rev=1.45&mark=26,56,60#26

The 'name' attribute type seems rarely used, so I added it below the
"strict mode" line in my patch.

Comment 1

[Wan-Teh Chang]

With the patch, the 'pp' tool prints the Subject field as:

        Subject: "E=[e-mail],name=testing,CN=xxx,OU=xxx,
            O=xxx,L=xxx,ST=CA,C=US"

Comment 2

[Kaspar]

Comment on attachment 711986 [details] [diff] [review]
Patch

(In reply to Wan-Teh Chang from comment #0)
> The attached patch enables the 'pp' tool to prints the 'name' attribute.
> I believe a PSM patch is necessary to allow the Firefox certificate viewer
> to display the 'name' attribute.

Correct, see e.g. bug 407226 comment 2 (and bug 500333, which is related to Cert Viewer's display of EV certs, in particular).

> The 'name' attribute type seems rarely used, so I added it below the
> "strict mode" line in my patch.

That's preferrable, yes. "Name" was introduced with X.520(11/93), and is meant to be "the attribute supertype from which string attribute types typically used for naming may be formed" - i.e. common name, surname, given name, country name, state or provice name etc. (see Annex B of X.520 for the complete list). So, strictly speaking, name should be avoided whenever there is a more specific naming attribute.

Comment 3

[Robert Relyea]

Comment on attachment 711986 [details] [diff] [review]
Patch

r+ rrelyea...

At the very least, it should be in the oid table. I'm Also ok with adding it to alg1485.c as well.

bob

Comment 4

[Wan-Teh Chang]

Comment on attachment 711986 [details] [diff] [review]
Patch

https://hg.mozilla.org/projects/nss/rev/c6c62eccc654