Re: [pkix] [Technical Errata Reported] RFC5912 (3623)

[Carl Wallace <[e-mail]>]

The errata has multiple parts if you feel the MAX limit is unacceptable accept the type issue independently.

 Suggested limit change aligns with similar certificate serial number definition. 

On May 16, 2013, at 11:22 AM, "Jim Schaad" <[e-mail]> wrote:

> Reject
> 
> The serial number MUST be a positive integer assigned by the CA to
>   each certificate.
> 
> 
>> -----Original Message-----
>> From: RFC Errata System [mailto:[e-mail]]
>> Sent: Thursday, May 16, 2013 12:08 PM
>> To: [e-mail]; [e-mail]; [e-mail];
>> [e-mail]; [e-mail]; [e-mail]
>> Cc: [e-mail]; [e-mail]; [e-mail]
>> Subject: [Technical Errata Reported] RFC5912 (3623)
>> 
>> The following errata report has been submitted for RFC5912, "New ASN.1
>> Modules for the Public Key Infrastructure Using X.509 (PKIX)".
>> 
>> --------------------------------------
>> You may review the report below and at:
>> http://www.rfc-editor.org/errata_search.php?rfc=5912&eid=3623
>> 
>> --------------------------------------
>> Type: Technical
>> Reported by: Carl Wallace <[e-mail]>
>> 
>> Section: 14
>> 
>> Original Text
>> -------------
>>   -- CRL number extension OID and syntax
>>   ext-CRLNumber EXTENSION ::= {SYNTAX
>>       INTEGER (0..MAX) IDENTIFIED BY id-ce-cRLNumber }
>>   id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
>> 
>>   CRLNumber ::= INTEGER (0..MAX)
>> 
>> Corrected Text
>> --------------
>>   -- CRL number extension OID and syntax
>>   CRLNumber ::= INTEGER
>> 
>>   ext-CRLNumber EXTENSION ::= {SYNTAX
>>       CRLNumber IDENTIFIED BY id-ce-cRLNumber }
>>   id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
>> 
>> 
>> Notes
>> -----
>> The CRLNumber extension was not defined to use the CRLNumber type.  The
>> CRLNumber type uses MAX to limit the maximum value.  This limitation is
>> inconsistent with section 5.2.3 and Appendix B, which allow CRLNumber
>> values up to 20 octets in length.
>> 
>> Instructions:
>> -------------
>> This errata is currently posted as "Reported". If necessary, please use
> "Reply
>> All" to discuss whether it should be verified or rejected. When a decision
> is
>> reached, the verifying party (IESG) can log in to change the status and
> edit the
>> report, if necessary.
>> 
>> --------------------------------------
>> RFC5912 (draft-ietf-pkix-new-asn1-08)
>> --------------------------------------
>> Title               : New ASN.1 Modules for the Public Key Infrastructure
> Using
>> X.509 (PKIX)
>> Publication Date    : June 2010
>> Author(s)           : P. Hoffman, J. Schaad
>> Category            : INFORMATIONAL
>> Source              : Public-Key Infrastructure (X.509)
>> Area                : Security
>> Stream              : IETF
>> Verifying Party     : IESG
>