IZ73340: COMPARE DOMAINCOMPONENT (DC) AND EMAILADDRESS OF DOMAINNAME(X500NAME) IN CASE INSENSITIVE MANNER.

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • APAR Description : Compare DomainComponent (DC) and EMAILADDRESS
    of DomainName(X500Name) in case insensitive manner  .
    
    JDK Affected : JDK 142, 5.0, 6.0
    
    JAR Affected: ibmpkcs.jar
    
    Problem Description :
    Values of DomainComponent(DC) and emailaddress attributes in
    DomainName(X500Name) are encoded as IA5String .  If the values
    are same but in different case, their DER values don't match
    causing the equality check to fail.
    
    For example, X500Name of following pairs of DNs does not match
    (equals returns false) currently :
    
    CN=GROUP-1,DC=IBM,DC=COM
    CN=GROUP-1,dc=ibm,dc=com
    
    CN=group-1, DC=ibm, DC=com, EMAILADDRESS=abc@xyz.com
    CN=group-1, DC=ibm, DC=com, EMAILADDRESS=ABC@XYZ.COM
    
    
    RFC 4519 describes DomainComponent (DC) and mentions that
    "equality matching rule is case insensitive" as below URL :
    http://tools.ietf.org/html/rfc4519
    
    Also RFC 2985 describes EMAILADDRESS as per below URL and
    mentions that "When comparing two email addresses, case is
    irrelevant".
    http://www.rfc-editor.org/rfc/rfc2985.txt
    
    So equality check of two Domain Names (X500Names) having same DC
    and emailaddress BUT in different case, should be successful.
    

Local fix

  • Level 3 to update
    

Problem summary

  •    IA5String matching.   Compare DomainComponent
    (DC) and EMAILADDRESS of DomainName(X500Name) in case
    insensitive manner
    
    PROBLEM DESCRIPTION:
    
    Values of DomainComponent(DC) and emailaddress attributes in
    DomainName(X500Name) are encoded as IA5String .  If the values
    are same but in different case, their DER values don't match
    causing the equality check to fail.
    
    For example, X500Name of following pairs of DNs does not match
    (equals returns false) currently :
    
    CN=GROUP-1,DC=IBM,DC=COM
    CN=GROUP-1,dc=ibm,dc=com
    
    CN=group-1, DC=ibm, DC=com, EMAILADDRESS=xyz@ibm.com
    CN=group-1, DC=ibm, DC=com, EMAILADDRESS=XYZ@IBM.COM
    
    RFC 4519 describes DomainComponent (DC) and mentions that
    "equality matching rule is case insensitive" as below URL :
    http://tools.ietf.org/html/rfc4519
    
    Also RFC 2985 describes EMAILADDRESS as per below URL and
    mentions that "When comparing two email addresses, case is
    irrelevant".
    http://www.rfc-editor.org/rfc/rfc2985.txt
    
    So equality check of two Domain Names (X500Names) having same DC
    and emailaddress BUT in different case, should be successful.
    

Problem conclusion

  • The problem can be resolved by converting DC and EMAILADDRESS
    values to LowerCase before encoding these value in IA5String.
    This way the DER values will be same and equality check would
    succeed.
    
    The associated Hursley CMVC defect is 163952.
    The associated Austin CMVC defect is 110191.
    The fix is being dropped for:
    1.4.2 SR13 FP5
    5.0.0 SR12
    6.0.0 SR8
    
    The build level of this jar for Java 1.4.2, 5.0, and 6.0 is
    20100326.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IZ73340

  • Reported component name

    TIVOLI JAVA PKC

  • Reported component ID

    TIVSECPKC

  • Reported release

    100

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2010-03-24

  • Closed date

    2010-04-02

  • Last modified date

    2013-10-21

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    TIVOLI JAVA PKC

  • Fixed component ID

    TIVSECPKC

Applicable component levels

  • R100 PSY

       UP



Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

Tivoli Components - Java Security
PKCS

Software version:

100

Reference #:

IZ73340

Modified date:

2013-10-21

Translate my page

Machine Translation

Content navigation