IETF Logo Mail Archive

Re: [pkix] Managing Long-Lived CA certs

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 18 July 2017 14:17 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: pkix@ietfa.amsl.com
Delivered-To: pkix@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E8E121286B2 for <pkix@ietfa.amsl.com>; Tue, 18 Jul 2017 07:17:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.201
X-Spam-Level:
X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vs4wq3fR7Nd7 for <pkix@ietfa.amsl.com>; Tue, 18 Jul 2017 07:17:30 -0700 (PDT)
Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1.2 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B597812706D for <pkix@ietf.org>; Tue, 18 Jul 2017 07:17:29 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1500387449; x=1531923449; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=PJJhFJs+6v0h/cgU4Q640fXt/AovodJiGq2JnmoAVuc=; b=IyimRhLZJQhi6QEL6IjdfljjZ+wD7V6ZmwAPq3MwOsb9WLHrQk3n2AuQ EkmitX2xxjoB8uwExbcBmo3JMGx3ziX8QKEDmzvuVlqFGStURaOYO0w4H G8DYbB0hxb6tMP9ez2XJxpIUM9rgOVcjcBZLYkctP3hGp7kG7e02VeM0/ RpVMvkOyVhLwffNa1M2S8xG0KAH7fDJJFEpXRZMIsssY4CGruf7j2S+2M faVNoghqArL4EXa48cLYnxAnuOgTQOe98wju1RcZT2mjDCK3MDMGXh9rL RAWrWrYewAnykCFDmRz5cvrLSk/m/a5E607MWsb6kvG4X9GEjmEAWjP3W g==;
X-IronPort-AV: E=Sophos;i="5.40,378,1496059200"; d="scan'208";a="166300096"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 10.6.3.2 - Outgoing - Outgoing
Received: from exchangemx.uoa.auckland.ac.nz (HELO uxcn13-tdc-a.UoA.auckland.ac.nz) ([10.6.3.2]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 19 Jul 2017 02:17:00 +1200
Received: from uxcn13-tdc-d.UoA.auckland.ac.nz (10.6.3.5) by uxcn13-tdc-a.UoA.auckland.ac.nz (10.6.3.22) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 19 Jul 2017 02:17:00 +1200
Received: from uxcn13-tdc-d.UoA.auckland.ac.nz ([fe80::6929:c5b:e4d6:fd92]) by uxcn13-tdc-d.UoA.auckland.ac.nz ([fe80::6929:c5b:e4d6:fd92%14]) with mapi id 15.00.1263.000; Wed, 19 Jul 2017 02:17:00 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "David A. Cooper" <david.cooper@nist.gov>
CC: PKIX <pkix@ietf.org>
Thread-Topic: [pkix] Managing Long-Lived CA certs
Thread-Index: AQHS/wfFsHzAHG/6DUqwsYmxTQJgoKJXVMeAgAGZvr3//+d/gIAAzL86
Date: Tue, 18 Jul 2017 14:16:59 +0000
Message-ID: <1500387403338.42595@cs.auckland.ac.nz>
References: <467c8936-f6aa-0853-878c-24fc8803c599@openca.org> <001501d2ff0e$00eddfa0$02c99ee0$@x500.eu> <1500348690922.69356@cs.auckland.ac.nz>, <27d212b4-c5a6-19d1-2afd-f18adaf21031@nist.gov>
In-Reply-To: <27d212b4-c5a6-19d1-2afd-f18adaf21031@nist.gov>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: [130.216.158.4]
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/lEQRUU1om8X_XE55cv9qdWt7KWI>
Subject: Re: [pkix] Managing Long-Lived CA certs
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/pkix/>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Jul 2017 14:17:32 -0000

David A. Cooper <david.cooper@nist.gov> writes:

>Can you provide a citation for your claim that "PKIX says you're not allowed
>to use it. No reason given, you just can't."?

Um, the PKIX RFCs for the last twenty years, starting with 2459:

   4.2.1.4  Private Key Usage Period

   This profile recommends against the use of this extension.  CAs
   conforming to this profile MUST NOT generate certificates with
   critical private key usage period extensions.

Peter.

v2.23.0 | Report a Bug | By Email