Re: [pkix] [Technical Errata Reported] RFC5280 (7164)

["David A. Cooper" <[e-mail]>]

I believe that this errata is incorrect. The text from RFC 5280 that is 
proposed to be modified is referring to the distributionPoint field of 
the issuingDistributionPoint extension, whereas the text that is quoted 
from X.509 is referring to the issuingDistributionPoint extension as a 
whole.

X.509 is noting that if there is no extension limiting the scope of the 
CRL, then the scope of the CRL must be all unexpired public-key 
certificates issued by the CRL issuer. The extension limiting the scope 
could be the issuingDistributionPoint extension or it could be some 
other extension (e.g., crlScope or AAissuingDistributionPoint). The text 
from Section 5.2.5 of RFC 5280 is about the case in which the 
issuingDistributionPoint extension is present, but the distributionPoint 
field in that extension is absent, in which case the scope of the CRL is 
presumably limited by some other field in the issuingDistributionPoint 
extension.

The submitter may be correct that RFC 5280 never explicitly says that 
the scope of a CRL must include all unexpired certificates issued by the 
CRL issuer unless the CRL contains an extension (or extensions) that 
limit the scope, but addressing that would involve a different change 
from the one proposed here.

On 10/14/22 12:39 PM, RFC Errata System wrote:
> The following errata report has been submitted for RFC5280,
> "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".
>
> --------------------------------------
> Type: Technical
> Reported by: Aaron Gable <[e-mail]>
>
> Section: 5.2.5
>
> Original Text
> -------------
>     If the distributionPoint field is absent, the CRL MUST contain
>     entries for all revoked unexpired certificates issued by the CRL
>     issuer, if any, within the scope of the CRL.
>
> Corrected Text
> --------------
>     If the distributionPoint field is absent, the CRL MUST contain
>     entries for all revoked unexpired certificates issued by the CRL
>     issuer.
>
> Notes
> -----
> The removed phrase does not appear in the original text that this requirement is derived from, ITU-T Rec. X.509 (08/2005) Section 8.6.2.2: "If the issuing distribution point field, the AA issuing distribution point field, and the CRL scope field are all absent, the CRL shall contain entries for all revoked unexpired public-key certificates issued by the CRL issuer."
>
> The removed phrase does not serve to create a stricter requirement; rather it creates a looser requirement which allows a CRL which does contain entries for all revoked unexpired certificates *within its scope* to not include the distributionPoint field. Given that the distributionPoint field serves an important security purpose in preventing substitution attacks, it is unlikely that this loosening was the intent of the original authors.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC5280 (draft-ietf-pkix-rfc3280bis-11)
> --------------------------------------
> Title               : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
> Publication Date    : May 2008
> Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk
> Category            : PROPOSED STANDARD
> Source              : Public-Key Infrastructure (X.509)
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG