[pkix] [Editorial Errata Reported] RFC5280 (7634)

RFC Errata System <rfc-editor@rfc-editor.org> Fri, 08 September 2023 21:15 UTC

To: rfc-editor@rfc-editor.org
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: ietf@nharper.org, david.cooper@nist.gov, stefans@microsoft.com, stephen.farrell@cs.tcd.ie, sharon.boeyen@entrust.com, housley@vigilsec.com, wpolk@nist.gov, pkix@ietf.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20230908211555.33D6BE5EA7@rfcpa.amsl.com>
Date: Fri, 08 Sep 2023 14:15:55 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/1bNA6boFTL1aH-GOBs8m_DB9-l8>
Subject: [pkix] [Editorial Errata Reported] RFC5280 (7634)
Precedence: list

The following errata report has been submitted for RFC5280,
"Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7634

--------------------------------------
Type: Editorial
Reported by: Nick Harper <ietf@nharper.org>

Section: 4.1

Original Text
-------------
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signatureValue BIT STRING }

Corrected Text
--------------
Certificate ::= SEQUENCE {
tbsCertificate TBSCertificate,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING }

Notes
-----
The definition in section 4.1 disagrees with the definition in appendix A.1 (page 116) on whether the name of the field containing the signature is "signatureValue" or "signature". This error appears in RFC 3280 and RFC 2459 as well.

The versions of X.509 in force when RFCs 2459, 3280, and 5280 were published use neither of those names. (Those versions of X.509 considered a signature to be an encrypted hash and called the field "encrypted".) The current version, ITU-T X.509 (10/2019), defines this field to be "signature" in section 6.2.1. (X.509 defines the Certificate type using a component type of SIGNATURE, which has two fields named "algorithmIdentifier" and "signature".)

In addition to changing the field name in the definition of the Certificate type in section 4.1, the title and text of subsection 4.1.1.3 should be updated to replace "signatureValue" with "signature".

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
can log in to change the status and edit the report, if necessary.

--------------------------------------
RFC5280 (draft-ietf-pkix-rfc3280bis-11)
--------------------------------------
Title : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Publication Date : May 2008
Author(s) : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk
Category : PROPOSED STANDARD
Source : Public-Key Infrastructure (X.509)
Area : Security
Stream : IETF
Verifying Party : IESG

[pkix] [Editorial Errata Reported] RFC5280 (7634) RFC Errata System
Re: [pkix] [Editorial Errata Reported] RFC5280 (7… Russ Housley
Re: [pkix] [Editorial Errata Reported] RFC5280 (7… Rebecca VanRheenen