Re: Are there DName encoding samples?

      Looking at the output and considering the input, the only things
clearly wrong are the following:

1     The Java API is dropping trailing spaces (see the ST field) unless
they are surrounded by quotes.  The input fed to the Java API probably
needs to convert an escaped trailing space to be framed by quotes or to
2     The MS API thinks that two consecutive double quotes is the correct
escape for a double quote.  This can be post-processed easily enough.

            Tom Gindin

"Harada" <> on 03/10/2002 07:39:55 PM

To:    Tom Gindin/Watson/IBM@IBMUS
cc:    <>
Subject:    Re: Are there DName encoding samples?


 This is an additional information of the process creating the previous
e-mail's XML Signature.
I created the examples not to escape by my processor.
 I used JDK1.4 on Windows 98, and Internet Explorer 5.5.

The first example is created by a key generated by a batch file of the
(I entered the letters #x11,.. to the batch file by debug command .)

keytool -genkey -alias alias -keyalg RSA -keysize 2048 -sigalg
SHA1withRSA -dname "CN=HARADA\"KAZUYUKI \", OU=\#Project\,A\+XML\;\<Kiban\>
, O=\"FUJITSU\\limited;\", L=YOKOAMA
SI  , S=\"KANAGAWA KEN \", C=JP" -keypass keypass  -storepass storepass -v

And I created a XML Signature for the key of "alias".

The second example is created for a certificate by Fujitsu's tool .
(If there are the letters #x11.. , the command fails. So I don't set.)

"%SMEE_HOME%\cmmakecsr" -ed "%CMIPATH%" -sd "%SLOTPATH%" -tl tokenLabel -of
D:\src\dom\dsig\tool\smee.csr -f TEXT -c JP -cn "HARADA\"KAZUYUKI \""   -o
FUJITSU\limited;  -ou "#Project,A+XML;<Kiban>"  -ea -l "YOKO AMA  SI"   -s "KANAGAWA KEN " -sa
SHA1 -kt RSA -kb 2048  -p keypass

 And the resulting CSR file is

Country: JP
Email Address:
Organization: FUJITSU\limited;
Organization Unit: #Project,A+XML;<Kiban>
Locality: YOKO AMA  SI















I created a XML Signature for a key of the certificate.

The third is created by importing the pfx file that I exported the second
example's key by a Fujitsu's tool.
I don't add the pfx file's information but I believe the ceritificate is
same as the second example.

 Unicode #x11 causes error as XML document, so I think I should escape the
letters #x00-#x1F.
But it is too difficult for me to decode DNames got by MS or Java API and
encode correctly.

----- Original Message -----
From: "Tom Gindin" <>
To: "Harada" <>
Cc: <>
Sent: Saturday, March 09, 2002 10:00 PM
Subject: Re: Are there DName encoding samples?

      I am a little confused by the procedure here.  You're not supposed to
escape anything in creating the certificate, just in creating the X509Data
fields.  If you do that, the fact that running this transform multiple
times in the same direction produces different results than running it once
should not hurt you.
      My impression was that the transform defined in the spec defined what
should happen when you convert the certificate's DER (or BER) encoding of a
Distinguished Name to XML.  You may need to code a reverse transform into
either DER or RFC 2253 format to reach the format other API's want.  In
particular, that reverse transform will need to get rid of entity
definitions like &gt.  The problems this leaves seem to be restricted to
quote framing - the different results for ST and L (obviously determined by

the trailing space), and the bizarre result for CN, are things which an
implementation would need to avoid.
      The work you are doing seems quite valuable.  Good luck!

            Tom Gindin

"Harada" <> on 03/09/2002 12:40:21 AM
Sent by:

To:    <>
Subject:    Re: Are there DName encoding samples?


 This is an report of DName encoding implementation.

 I tried implementing the encoding, and find something and report it.
For Java and MS Crypto, DNames seem to be encoded.

 For an example of Java, the DName got by the API is
<X509SubjectName>CN=HARADA\"KAZUYUKI \", OU="#Project,A+XML;&lt;Kiban&gt;",
O="FUJITSU\\limited;", L="YOKOAMA
SI", ST=KANAGAWA KEN, C=JP</X509SubjectName>
(I succeeded containing letters #x11, #x1C, #x0A by keytool.)

 Similar DName in another key store,
(I cannot creat a csr containing the letters #x11,.. for it, so I replaced
the letters to spaces.)
<X509SubjectName>CN=HARADA\"KAZUYUKI \", OU="#Project,A+XML;&lt;Kiban&gt;",
O="FUJITSU\\limited;", L="YOKO AMA  SI", ST="KANAGAWA KEN ", C=JP,</X509SubjectName>

 And exporting this certificate to pfx file and importing to MS Crypto,
I get a XML Signature of
<X509SubjectName>, C=JP, S="KANAGAWA KEN ",
L=YOKO AMA  SI, O="FUJITSU\limited;", OU="#Project,A+XML;&lt;Kiban&gt;",
CN="HARADA""KAZUYUKI """</X509SubjectName>

 Now I am thinking my signature processor SHOULD NOT escaping the letters :
",", "+", """, "\", "<", ">", ";", or beggining "#".
(It is escaped in obedience to MS or Java API.)
And my processor SHOULD escape characters of Unicode range \x00 - \x1f.

----- Original Message -----
From: "Harada" <>
To: "Tom Gindin" <>
Cc: <>
Sent: Tuesday, March 05, 2002 10:04 PM
Subject: Re: Are there DName encoding samples?
> Gindin-san
>  Thank you very much.
>  I was led into wrong way missing a simple example.
> I know little RFC 2253, and my processor produces as:
> <X509IssuerName>CN=J. Random Nerd\,  O=Dewey\, Cheatham\, \+ Howe\,
>               L=Nowhere\, ST=AK\, C=US</X509IssuerName>
>  It's my misunderstanding.

Received on Monday, 11 March 2002 12:42:30 UTC