Re: [pkix] [Technical Errata Reported] RFC5280 (6414)

[Stefan Santesson <[e-mail]>]

Russ,

 

If I read the proposal correct Rob is providing text where the following is allowed:

 
DS
KA
KE
DS + KA
DS + KE
 

And he argues that the current wording suggest that only the following is allowed:

 
DS
KA
KE
 

Right?

(DS = digitalISignature, KA = keyAgreement, KE = keyEncipherment)

 

Stefan Santesson 

 

From: Russ Housley <[e-mail]>
Date: Thursday, 28 January 2021 at 17:18
To: Rob Stradling <[e-mail]>
Cc: "Roman D. Danyliw" <[e-mail]>rg>, Ben Kaduk <[e-mail]>du>, Stephen Kent <[e-mail]>om>, IETF PKIX <[e-mail]>rg>, Stefan Santesson <[e-mail]>om>, David Cooper <[e-mail]>ov>, Tim Polk <[e-mail]>ov>, Stephen Farrell <[e-mail]>
Subject: Re: [Technical Errata Reported] RFC5280 (6414)

 

Rob:

 

In my example, neither the keyEncipherment nor the keyAgreement bit is set.

 

Russ



On Jan 28, 2021, at 11:17 AM, Rob Stradling <[e-mail]> wrote:

 

Hi Russ.

 

I'm afraid I don't understand your objection.  Your use case of setting only the digitalSignature bit is permitted both by the Original Text and by my Proposed Text.  (With my Proposed Text, you would choose the "or" option of the "and/or" instead of the "and" option).

 

The reason for the erratum is that neither digitalSignature+keyEncipherment nor digitalSignature+keyAgreement seem to be permitted by the Original Text.

 

From: Russ Housley <[e-mail]>
Sent: 28 January 2021 16:07
To: Rob Stradling <[e-mail]>
Cc: Roman D. Danyliw <[e-mail]>rg>; Ben Kaduk <[e-mail]>du>; Stephen Kent <[e-mail]>om>; IETF PKIX <[e-mail]>rg>; Stefan Santesson <[e-mail]>om>; David Cooper <[e-mail]>ov>; [e-mail]<[e-mail]>; Stephen Farrell <[e-mail]>
Subject: Re: [Technical Errata Reported] RFC5280 (6414)

 

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


Rob:

The proposed rewording of the comment is not correct.  Consider an ECDSA key that will be used with TLS 1.3.  In that case, only the digitalSignature key usage would be set.

I think the original OR is correct.

Russ


> On Jan 28, 2021, at 10:44 AM, RFC Errata System <[e-mail]> wrote:
>
> The following errata report has been submitted for RFC5280,
> "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".
>
> --------------------------------------
> You may review the report below and at:
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.rfc-editor.org%2Ferrata%2Feid6414&amp;data=04%7C01%7Crob%40sectigo.com%7Cdce250f148ea4d995db108d8c3a6ce56%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637474468512413977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=8hy5qssHrRM%2BEOM2NX8rEJSJqGV%2FWhu7top4hdmsXgU%3D&amp;reserved=0
>
> --------------------------------------
> Type: Technical
> Reported by: Rob Stradling <[e-mail]>
>
> Section: 4.2.1.12
>
> Original Text
> -------------
>   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
>   -- TLS WWW server authentication
>   -- Key usage bits that may be consistent: digitalSignature,
>   -- keyEncipherment or keyAgreement
>
> Corrected Text
> --------------
>   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
>   -- TLS WWW server authentication
>   -- Key usage bits that may be consistent: digitalSignature
>   -- and/or (keyEncipherment or keyAgreement)
>
> Notes
> -----
> In https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fzmap%2Fzlint%2Fissues%2F553&amp;data=04%7C01%7Crob%40sectigo.com%7Cdce250f148ea4d995db108d8c3a6ce56%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637474468512413977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=Kf06%2FZ9o9VIMBcNRiCOk2L%2FUNA7dlgCP6ywIYJZH37I%3D&amp;reserved=0 there's been some disagreement and confusion about how to correctly interpret the "or" in the Original Text.  "You can only set one of these three bits" is one interpretation, and it's hard to argue that this interpretation is inconsistent with the Original Text.
>
> However, digitalSignature+keyEncipherment makes sense for an RSA leaf certificate, and digitalSignature+keyAgreement makes sense for an ECC leaf certificate.  Both are widely used, to enable ephemeral and non-ephemeral TLS ciphersuites in conjunction with a single server certificate.
>
> Given that RFC5480 section 3 explicitly permits digitalSignature+keyAgreement in an ECC leaf certificate, I think it's likely that my proposed Corrected Text conveys the RFC5280 authors' intended meaning.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC5280 (draft-ietf-pkix-rfc3280bis-11)
> --------------------------------------
> Title               : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
> Publication Date    : May 2008
> Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk
> Category            : PROPOSED STANDARD
> Source              : Public-Key Infrastructure (X.509)
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG