Re: [pkix] [Technical Errata Reported] RFC5912 (3623)

The certificate serialNumber is limited to [0 .. 256^20] in value.
The CRLNumber is limited to [-256^20 .. 256^20], it's not said to be a
positive integer.

2013/5/16 Jim Schaad <jimsch@augustcellars.com>:
> Reject
>
> The serial number MUST be a positive integer assigned by the CA to
>    each certificate.
>
>
>> -----Original Message-----
>> From: RFC Errata System [mailto:rfc-editor@rfc-editor.org]
>> Sent: Thursday, May 16, 2013 12:08 PM
>> To: paul.hoffman@vpnc.org; jimsch@exmsft.com; stephen.farrell@cs.tcd.ie;
>> turners@ieca.com; kent@bbn.com; stefan@aaa-sec.com
>> Cc: carl@redhoundsoftware.com; pkix@ietf.org; rfc-editor@rfc-editor.org
>> Subject: [Technical Errata Reported] RFC5912 (3623)
>>
>> The following errata report has been submitted for RFC5912, "New ASN.1
>> Modules for the Public Key Infrastructure Using X.509 (PKIX)".
>>
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata_search.php?rfc=5912&eid=3623
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: Carl Wallace <carl@redhoundsoftware.com>
>>
>> Section: 14
>>
>> Original Text
>> -------------
>>    -- CRL number extension OID and syntax
>>    ext-CRLNumber EXTENSION ::= {SYNTAX
>>        INTEGER (0..MAX) IDENTIFIED BY id-ce-cRLNumber }
>>    id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
>>
>>    CRLNumber ::= INTEGER (0..MAX)
>>
>> Corrected Text
>> --------------
>>    -- CRL number extension OID and syntax
>>    CRLNumber ::= INTEGER
>>
>>    ext-CRLNumber EXTENSION ::= {SYNTAX
>>        CRLNumber IDENTIFIED BY id-ce-cRLNumber }
>>    id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
>>
>>
>> Notes
>> -----
>> The CRLNumber extension was not defined to use the CRLNumber type.  The
>> CRLNumber type uses MAX to limit the maximum value.  This limitation is
>> inconsistent with section 5.2.3 and Appendix B, which allow CRLNumber
>> values up to 20 octets in length.
>>
>> Instructions:
>> -------------
>> This errata is currently posted as "Reported". If necessary, please use
> "Reply
>> All" to discuss whether it should be verified or rejected. When a decision
> is
>> reached, the verifying party (IESG) can log in to change the status and
> edit the
>> report, if necessary.
>>
>> --------------------------------------
>> RFC5912 (draft-ietf-pkix-new-asn1-08)
>> --------------------------------------
>> Title               : New ASN.1 Modules for the Public Key Infrastructure
> Using
>> X.509 (PKIX)
>> Publication Date    : June 2010
>> Author(s)           : P. Hoffman, J. Schaad
>> Category            : INFORMATIONAL
>> Source              : Public-Key Infrastructure (X.509)
>> Area                : Security
>> Stream              : IETF
>> Verifying Party     : IESG
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix

--
Erwann.