[pkix] Re: [Errata Held for Document Update] RFC5280 (8789)

[Corey Bonnell <[e-mail]>]

I'm confused. Isn't this erratum a duplicate of the verified, technical 
erratum https://www.rfc-editor.org/errata/eid5802?

-----Original Message-----
From: RFC Errata System <[e-mail]>
Sent: Tuesday, March 3, 2026 12:34 PM
To: [e-mail]; [e-mail]; [e-mail]; 
[e-mail]; [e-mail]; [e-mail]; 
[e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]; 
[e-mail]
Subject: [pkix] [Errata Held for Document Update] RFC5280 (8789)

The following errata report has been held for document update for RFC5280, 
"Internet X.509 Public Key Infrastructure Certificate and Certificate 
Revocation List (CRL) Profile".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8789

--------------------------------------
Status: Held for Document Update
Type: Editorial

Reported by: Elizabeth Peraza Slator <[e-mail]> Date 
Reported: 2026-02-28 Held by: Paul Wouters (IESG)

Section: GLOBAL

Original Text
-------------
Section 4.2.1.12 says:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS WWW server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS WWW client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
It should say:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
Notes:

The proposed change removes the WWW part of the description. In practice these 
object identifiers are used for server and client applications, but not 
necessarily web applications. In particular:
- openssl verification considers them unconditionally even if the server is 
not a web server or the client a web client
- There is no object identifier that can be used for protocols like SMTP, 
IMAP, POP3, LDAP, radius, ...; in practice all these protocols are deployed 
with the identifiers for WWW
- Standards like common criteria assume that these object identifiers are for 
generic server and clients [0].

[0]. https://www.niap-ccevs.org/MMO/PP/-442-/#FCS_TLSC_EXT.1.1

Report New Errata

Corrected Text
--------------
Section 4.2.1.12 says:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS WWW server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS WWW client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
It should say:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
Notes:

The proposed change removes the WWW part of the description. In practice these 
object identifiers are used for server and client applications, but not 
necessarily web applications. In particular:
- openssl verification considers them unconditionally even if the server is 
not a web server or the client a web client
- There is no object identifier that can be used for protocols like SMTP, 
IMAP, POP3, LDAP, radius, ...; in practice all these protocols are deployed 
with the identifiers for WWW
- Standards like common criteria assume that these object identifiers are for 
generic server and clients [0].

[0]. https://www.niap-ccevs.org/MMO/PP/-442-/#FCS_TLSC_EXT.1.1

Report New Errata

Notes
-----
Sec AD (Paul Wouters): Changed to Editorial,  as the suggested changes are in 
an ASN.1 comment

--------------------------------------
RFC5280 (draft-ietf-pkix-rfc3280bis-11)
--------------------------------------
Title               : Internet X.509 Public Key Infrastructure Certificate and 
Certificate Revocation List (CRL) Profile
Publication Date    : May 2008
Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. 
Housley, W. Polk
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
pkix mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]