Paul,
I think Christian's point was that introducing new attribute
types for DNs into DSAs was a problem, not just DUAs, but maybe I
misunderstood. This was a concern of mine when we changed the initial
key management spec to remove attribute constraints and, instead go
with a list of attribute types for all directory applications, not
just PEM, to be maintained by the IANA, something we still have not
put in place. My general concern was that PEM UAs would not know
the name of the attribute and the syntax type and thus would not be
able to accurately label and display the attribute value.
By the way, I understand the role of matching rules
like "case ignore string" for directory searches. Could you elaborate
on how a PEM implementation needs to make use of these rules?
Steve