Re: [pkix] [Errata Held for Document Update] RFC4210 (5731)

[Roman Danyliw <[e-mail]>]

Hi!

Thanks for the feedback.  I marked this “hold for document update” because action on this errata is being taken in Section 2.22 of  https://datatracker.ietf.org/doc/draft-ietf-lamps-cmp-updates/ (an update to RFC4210).  If the something needs to be refined now is a good time to do it since the document is in IETF Last Call.

Regards,
Roman

From: iesg <[e-mail]> On Behalf Of Carlisle Adams
Sent: Friday, April 29, 2022 3:39 PM
To: RFC Errata System <[e-mail]>; [e-mail]; [e-mail]; [e-mail]; [e-mail]
Cc: Roman Danyliw <[e-mail]>; [e-mail]; [e-mail]
Subject: Re: [Errata Held for Document Update] RFC4210 (5731)

Hi all,

Thank you for this note, but I don't really see the problem.  A CA can certainly have more than one certificate (in particular, one key pair and its corresponding certificate for signing EE certificates, and another key pair and its corresponding certificate for signing protocol messages).  In all these certificates, "the name of the CA" will be the same, so there is no ambiguity if this name is in the recipient field of requests and in the sender field of responses.  (Specifically, this does not​ imply that the certificate signing key must be used to also sign protocol message responses.)

Note that there is a field called "extraCerts" where the CA can put the certificate for the public key required to verify protocol message signatures, if it wishes.

Carlisle.

________________________________
From: RFC Errata System <[e-mail]<mailto:[e-mail]>>
Sent: April 26, 2022 10:03 PM
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: [Errata Held for Document Update] RFC4210 (5731)

Attention : courriel externe | external email

The following errata report has been held for document update
for RFC4210, "Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid5731

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Lijun Liao <[e-mail]<mailto:[e-mail]>>
Date Reported: 2019-05-22
Held by: Roman Danyliw (IESG)

Section: GLOBAL

Original Text
-------------
N/A

Corrected Text
--------------
N/A

Notes
-----
In appendixes D.4, D.5, E.5 and E.6, the recipient field of requests and the sender field of responses are specified as "the name of the CA". It is no problem for CA which signs the CMP response.

However, as best practice, the CA's private key which is used to sign the certificates, is NOT RECOMMENDED to sign/decrypt the communication messages. In this case, another entity (private key + certificate) is used to decrypt the incoming messages and sign the outgoing ones.

The text and comment for the fields "recipient" in requests and "sender" in responses need to be corrected to the case described above. If you think the original text and comment are correct, then we need instruction on how to handle this case.

--------------------------------------
RFC4210 (draft-ietf-pkix-rfc2510bis-09)
--------------------------------------
Title               : Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP)
Publication Date    : September 2005
Author(s)           : C. Adams, S. Farrell, T. Kause, T. Mononen
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG