Polar, I suggest we list PKIX RFC3280 as the standard specification for rfc822Name and x500Name comparison functions, although it is not complete. I have sent a query to the ietf-pkix mailing list about some ambiguities in the specifications for both types of names. Nevertheless, I think we can expect that people will want to do the same types of matching and equality checks in XACML that are currently done by browsers in handling X509 certificates with these two name types. Anne Anderson -- Anne H. Anderson Email:
Anne.Anderson@Sun.COM Sun Microsystems Laboratories 1 Network Drive,UBUR02-311 Tel: 781/442-0928 Burlington, MA 01803-0902 USA Fax: 781/442-1692