Re: [pkix] [Technical Errata Reported] RFC5280 (6830)

[Stefan Santesson <[e-mail]>]

I agree

Den 2022-02-02 kl. 18:16, skrev Russ Housley:
> This seems correct to me.
>
>> On Feb 2, 2022, at 12:08 PM, RFC Errata System <[e-mail]> wrote:
>>
>> The following errata report has been submitted for RFC5280,
>> "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".
>>
>> --------------------------------------
>> You may review the report below and at:
>> https://www.rfc-editor.org/errata/eid6830
>>
>> --------------------------------------
>> Type: Technical
>> Reported by: Corey Bonnell <[e-mail]>
>>
>> Section: Appendix A.1
>>
>> Original Text
>> -------------
>> -- Note - upper bounds on string types, such as TeletexString, are
>> -- measured in characters.  Excepting PrintableString or IA5String, a
>> -- significantly greater number of octets will be required to hold
>> -- such a value.  As a minimum, 16 octets, or twice the specified
>> -- upper bound, whichever is the larger, should be allowed for
>> -- TeletexString.  For UTF8String or UniversalString at least four
>> -- times the upper bound should be allowed.
>>
>> Corrected Text
>> --------------
>> -- Note - upper bounds on string types, such as TeletexString, are
>> -- measured in characters.  Excepting PrintableString or IA5String, a
>> -- significantly greater number of octets will be required to hold
>> -- such a value.  As a minimum, 16 octets, or twice the specified
>> -- upper bound, whichever is the larger, should be allowed for
>> -- TeletexString.  For UTF8String or UniversalString, four
>> -- times the upper bound should be allowed.
>>
>> Notes
>> -----
>> "at least four times" is likely a holdover from RFC 3280, as the same text exists in that RFC. In RFC 3280, the definition of UTF-8 in UTF8String was normatively referencing RFC 2279, which allowed for a maximum of 6 octets to represent a single Unicode character in UTF-8. However, RFC 5280 was updated to normatively reference RFC 3629, which restricts the allowed set of characters in a UTF-8 string to match those allowed in UTF-16 (i.e., the BMP and 16 supplementary planes as opposed to all 32k planes). As a result, the maximum length for a single RFC 3629 UTF-8 character is 4 octets, rendering the guidance of "at least four times" wholly unnecessary; "four times" is sufficient in all cases.
>>
>> Instructions:
>> -------------
>> This erratum is currently posted as "Reported". If necessary, please
>> use "Reply All" to discuss whether it should be verified or
>> rejected. When a decision is reached, the verifying party  
>> can log in to change the status and edit the report, if necessary. 
>>
>> --------------------------------------
>> RFC5280 (draft-ietf-pkix-rfc3280bis-11)
>> --------------------------------------
>> Title               : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
>> Publication Date    : May 2008
>> Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk
>> Category            : PROPOSED STANDARD
>> Source              : Public-Key Infrastructure (X.509)
>> Area                : Security
>> Stream              : IETF
>> Verifying Party     : IESG