Re: [Anima] [Technical Errata Reported] RFC8995 (6649)

Chris Smiley <csmiley@amsl.com> Tue, 27 July 2021 20:43 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Chris Smiley <csmiley@amsl.com>
In-Reply-To: <20210727022931.B7906F40710@rfc-editor.org>
Date: Tue, 27 Jul 2021 13:43:40 -0700
Cc: RFC Errata System <rfc-editor@rfc-editor.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <A7B3B9AB-33F5-4A6B-832C-B7B206732E13@amsl.com>
References: <20210727022931.B7906F40710@rfc-editor.org>
To: "Max Pritikin (pritikin)" <pritikin@cisco.com>, anima@ietf.org, jiangsheng@huawei.com, Michael Richardson <mcr+ietf@sandelman.ca>, Kent Watsen <kent+ietf@watsen.net>, tte+ietf@cs.fau.de, Michael.H.Behringer@gmail.com, Warren Kumari <warren@kumari.net>, Toerless Eckert <tte@cs.fau.de>, "Rob Wilton (rwilton)" <rwilton@cisco.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/62MykOnk1BR-3C8vDiNQHi4om0s>
Subject: Re: [Anima] [Technical Errata Reported] RFC8995 (6649)
Precedence: list

Greetings,

This errata reports a problem with Section 5.4/RFC 8995.  Upon further review, we believe 
it should point to Section 5.5.4./RFC 8995. 

We have updated accordingly.  Please let us know any concerns. 

Thank you.

RFC Editor/cs


> On Jul 26, 2021, at 7:29 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
> 
> The following errata report has been submitted for RFC8995,
> "Bootstrapping Remote Secure Key Infrastructure (BRSKI)".
> 
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid6649
> 
> --------------------------------------
> Type: Technical
> Reported by: Michael Richardson <mcr+ietf@sandelman.ca>
> 
> Section: 5.4
> 
> Original Text
> -------------
> Even when a domain CA is authenticated to the MASA, and there is
> strong sales channel integration to understand who the legitimate
> owner is, the above id-kp-cmcRA check prevents arbitrary end-entity
> certificates (such as an LDevID certificate) from having vouchers
> issued against them.
> 
> 
> Corrected Text
> --------------
> Even when a domain CA is authenticated to the MASA, and there is
> strong sales channel integration to understand who the legitimate
> owner is, the above id-kp-cmcRA check prevents arbitrary end-entity
> certificates (such as an LDevID certificate) from having vouchers
> issued against them.
> 
> add:
> The id-kp-cmcRA is an Extended Key Usage (EKU) attribute.
> When any EKU attribute it set, then the certificate MUST have all 
> related attributes set.  
> This means that the Registrar certificate MUST also have the 
> id-kp-clientAuth (for use with the MASA) and the id-kp-serverAuth 
> (for use with the Pledge) set.
> 
> 
> Notes
> -----
> https://mailarchive.ietf.org/arch/msg/anima/H6Xs_f3rQAh9acOEFXEYuoZZGls/
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC8995 (draft-ietf-anima-bootstrapping-keyinfra-45)
> --------------------------------------
> Title               : Bootstrapping Remote Secure Key Infrastructure (BRSKI)
> Publication Date    : May 2021
> Author(s)           : M. Pritikin, M. Richardson, T. Eckert, M. Behringer, K. Watsen
> Category            : PROPOSED STANDARD
> Source              : Autonomic Networking Integrated Model and Approach
> Area                : Operations and Management
> Stream              : IETF
> Verifying Party     : IESG
>

[Anima] [Technical Errata Reported] RFC8995 (6649) RFC Errata System
Re: [Anima] [Technical Errata Reported] RFC8995 (… Chris Smiley