#7 R0078 Use Distinguished Name instead of Common Name

[David]

R0078 said:

R0078: An SDC SERVICE PROVIDER SHALL use the following pm:InstanceIdentifier for identifying a known SDC PARTICIPANT that invoked a SERVICE OPERATION:
- @Root = "http://standards.ieee.org/downloads/11073/11073-20701-2018/DistinguishedName"
- @Extension = the Common Name of the Distinguished Name of the x.509 Certificate of the SDC PARTICIPANT.

However, the common name is not necessarily a unique portion of the Distinguished Name. Therefore I recommend the use of the full Distinguished Name of the x.509 certificate in order to make sure that the owner of the certificate is clearly identifiable.

[David]

It turned out that the format of the distinguished name is not unique.

/C=DE/O=Foo/CN=Bar is semantically equal to C=DE,O=Foo,CN=Bar. For the sake of simplicity we should add a requirement that defines a fixed format for the distinguished name. I propose the latter one, which is defined in RFC 4514.

[David]

Today I talked to our security managers. There is no rule that prevents a manufacturer from publishing multiple certificates under a single common name. It's even worse, distinguished names can be issued multiple times, too. We should add a requirement to SDC that ensures common names to be globally unique. Everything else makes R0078 pointless.

By introducing globally unique common names (any 64 character permutation) we avoid hassle with distinguished name encodings.

[Björn Andersen]

Is this related to [#23]?

[David]

It gently touches on that one, too. We need to make sure that participants in a network are reliably identifiable by their distinguished name or common name - preferably common name as this prevents any encoding issues. One suggestion is to transform UDI into UUID and make that a mandatory portion of a participant's common name. But even then we're still facing the problem challenge that is described in [#23].

[Lukas Deichmann]

As we cannot really make an assumption as to which part of a certificate makes it unique or identifies the participant, including the entire certificate in a common encoding is preferable.

An SDC SERVICE PROVIDER SHALL set pm:OperationInvokedReport/pm:ReportPart/pm:InvocationSource to
- @Root = “http://standards.ieee.org/downloads/11073/11073-20701-2018/X509Certificate/PEM”
- @Extension = being the X.509 certificate of the SDC PARTICIPANT that invoked the SERVICE OPERATION referenced by the enclosing report part, encoded as PEM text.