Re: [pkix] [Technical Errata Reported] RFC5280 (7661)

Russ Housley <housley@vigilsec.com> Thu, 28 September 2023 15:55 UTC

Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <20230928131036.D1CD013BB505@rfcpa.amsl.com>
Date: Thu, 28 Sep 2023 11:54:49 -0400
Cc: David Cooper <david.cooper@nist.gov>, Stephen Farrell <stephen.farrell@cs.tcd.ie>, "Roman D. Danyliw" <rdd@cert.org>, Paul Wouters <paul.wouters@aiven.io>, Stefan Santesson <stefan@aaa-sec.com>, ben.strauss@dell.com, IETF PKIX <pkix@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <4091FFAB-4E82-4D5F-B497-5C193366E456@vigilsec.com>
References: <20230928131036.D1CD013BB505@rfcpa.amsl.com>
To: RFC Editor <rfc-editor@rfc-editor.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/CaJ6VXH_tS7NLtqN3eIKMutk4Vg>
Subject: Re: [pkix] [Technical Errata Reported] RFC5280 (7661)
Precedence: list

Cross certification results in each CA issuing a certificate to the other.  Dropping the second sentence is not helpful in my view.

Russ


> On Sep 28, 2023, at 9:10 AM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
> 
> The following errata report has been submitted for RFC5280,
> "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".
> 
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid7661
> 
> --------------------------------------
> Type: Technical
> Reported by: Benjamin Strauss <ben.strauss@dell.com>
> 
> Section: 3.5
> 
> Original Text
> -------------
>      (g)  cross-certification:  Two CAs exchange information used in
>           establishing a cross-certificate.  A cross-certificate is a
>           certificate issued by one CA to another CA that contains a CA
>           signature key used for issuing certificates.
> 
> Corrected Text
> --------------
>      (g)  cross-certification:  Two CAs exchange information used in
>           establishing a cross-certificate.
> 
> Notes
> -----
> The removed sentence is factually inaccurate and misleading: "A cross-certificate is a certificate issued by one CA to another CA that contains a CA signature key used for issuing certificates." 
> A "signature key used for issuing certificates" would be a private key.  A certificate simply does not contain a private key.  A definition of "cross-certificate" for the purpose of this RFC is already provided in section 3.2, so there is no point in elaborating here.  
> (The definition given in section 3.2 conflicts with the narrower, and more generally used, definition given in RFC 4949, but that is beside the point.)
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC5280 (draft-ietf-pkix-rfc3280bis-11)
> --------------------------------------
> Title               : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
> Publication Date    : May 2008
> Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk
> Category            : PROPOSED STANDARD
> Source              : Public-Key Infrastructure (X.509)
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG

[pkix] [Technical Errata Reported] RFC5280 (7661) RFC Errata System
Re: [pkix] [Technical Errata Reported] RFC5280 (7… Russ Housley
Re: [pkix] [Technical Errata Reported] RFC5280 (7… David A. Cooper