Paul,
You may recall that 1422 specifies that the IPRA-maintained
database to detect DN conflicts calls for a canonical representation
of DNs in that database to avoid the concern you cited. The specific
canonical form was described in a detailed message that is not part
of the RFC but was exchanged among those of us worrying about how
to build and operate this database. This form called for removal
of all whitespace and transformation into all lower case.
I spoke with Mike Roe and he believes that a properly
functioning DSA would refuse to create an entry for an entity with the
same canonical DN as an existing entry, under the matching rules.
This alleviates my concerns about using these rules for matching in
local caches, IF we operate the IPRA database (which could be a
DSA) to catch potential DN conflicts, as specified in 1422.
Steve