[Anima] [Errata Held for Document Update] RFC8995 (6649)

RFC Errata System <rfc-editor@rfc-editor.org> Mon, 15 January 2024 10:16 UTC

To: mcr+ietf@sandelman.ca, pritikin@cisco.com, mcr+ietf@sandelman.ca, tte+ietf@cs.fau.de, Michael.H.Behringer@gmail.com, kent+ietf@watsen.net
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: rwilton@cisco.com, iesg@ietf.org, anima@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240115101618.6FEED1A49952@rfcpa.amsl.com>
Date: Mon, 15 Jan 2024 02:16:18 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima/sM2bpzNPTHJuAMbJju4b4KweP5Q>
Subject: [Anima] [Errata Held for Document Update] RFC8995 (6649)
Precedence: list

The following errata report has been held for document update 
for RFC8995, "Bootstrapping Remote Secure Key Infrastructure (BRSKI)". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6649

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Michael Richardson <mcr+ietf@sandelman.ca>
Date Reported: 2021-07-27
Held by: Rob Wilton (IESG)

Section: 5.5.4.

Original Text
-------------
Even when a domain CA is authenticated to the MASA, and there is
strong sales channel integration to understand who the legitimate
owner is, the above id-kp-cmcRA check prevents arbitrary end-entity
certificates (such as an LDevID certificate) from having vouchers
issued against them.


Corrected Text
--------------
Even when a domain CA is authenticated to the MASA, and there is
strong sales channel integration to understand who the legitimate
owner is, the above id-kp-cmcRA check prevents arbitrary end-entity
certificates (such as an LDevID certificate) from having vouchers
issued against them.

add:
The id-kp-cmcRA is an Extended Key Usage (EKU) attribute.
When any EKU attribute it set, then the certificate MUST have all 
related attributes set.  
This means that the Registrar certificate MUST also have the 
id-kp-clientAuth (for use with the MASA) and the id-kp-serverAuth 
(for use with the Pledge) set.


Notes
-----
https://mailarchive.ietf.org/arch/msg/anima/H6Xs_f3rQAh9acOEFXEYuoZZGls/

--------------------------------------
RFC8995 (draft-ietf-anima-bootstrapping-keyinfra-45)
--------------------------------------
Title               : Bootstrapping Remote Secure Key Infrastructure (BRSKI)
Publication Date    : May 2021
Author(s)           : M. Pritikin, M. Richardson, T. Eckert, M. Behringer, K. Watsen
Category            : PROPOSED STANDARD
Source              : Autonomic Networking Integrated Model and Approach
Area                : Operations and Management
Stream              : IETF
Verifying Party     : IESG

[Anima] [Errata Held for Document Update] RFC8995… RFC Errata System