[pkix] Re: [Technical Errata Reported] RFC5272 (8137)

[Michael StJohns <[e-mail]>]

Actually -

The text "The parameters for id-alg-noSignature..." implies an 
AlgorithmIdentifier rather than just an OBJECT IDENTIFIER.    Instead -

NoSignatureAlgorithm SIGNATURE-ALGORITHM ::= { IDENTIFIER 
id-alg-noSignature PARAMS TYPE DIGEST-ALGORITHM are preferredAbsent } -- 
the digest algorithm default is SHA1

Or something similar.

Mike


On 10/29/2024 11:47 AM, Russ Housley wrote:
> Sean Turner was looking at this recently.  Sean, can you offer an 
> opinion?
>
> Russ
>
>> On Oct 29, 2024, at 11:41 AM, Deb Cooley <[e-mail]> wrote:
>>
>> opinions?
>>
>> Deb
>>
>> On Sat, Oct 12, 2024 at 6:36 AM RFC Errata System 
>> <[e-mail]> wrote:
>>
>>     The following errata report has been submitted for RFC5272,
>>     "Certificate Management over CMS (CMC)".
>>
>>     --------------------------------------
>>     You may review the report below and at:
>>     https://www.rfc-editor.org/errata/eid8137
>>
>>     --------------------------------------
>>     Type: Technical
>>     Reported by: David von Oheimb <[e-mail]>
>>
>>     Section: C.1
>>
>>     Original Text
>>     -------------
>>     NoSignatureValue contains the hash of the certification request.
>>
>>     Corrected Text
>>     --------------
>>     NoSignatureValue contains the SHA-1 hash value of the
>>     certification request.
>>     The hash value given by NoSignatureValue SHOULD be ignored.
>>
>>     Notes
>>     -----
>>     The hash value was not sufficiently defined because the choice of
>>     the hash algorithm was not specified.
>>     At that time presumably the use of SHA-1 was implied.
>>
>>     I suggest requiring SHA-1 here simply for backward compatibility.
>>     >From today's perspective more flexibility may be demanded and
>>     SHA-1 likely no more is the best choice.
>>
>>     Anyway I see no real value in NoSignatureValue (pun intended), so
>>     it should not matter.
>>     For this reason I propose ignoring the hash value.
>>
>>     Instructions:
>>     -------------
>>     This erratum is currently posted as "Reported". (If it is spam, it
>>     will be removed shortly by the RFC Production Center.) Please
>>     use "Reply All" to discuss whether it should be verified or
>>     rejected. When a decision is reached, the verifying party
>>     will log in to change the status and edit the report, if necessary.
>>
>>     --------------------------------------
>>     RFC5272 (draft-ietf-pkix-2797-bis-07)
>>     --------------------------------------
>>     Title               : Certificate Management over CMS (CMC)
>>     Publication Date    : June 2008
>>     Author(s)           : J. Schaad, M. Myers
>>     Category            : PROPOSED STANDARD
>>     Source              : Public-Key Infrastructure (X.509)
>>     Stream              : IETF
>>     Verifying Party     : IESG
>>
>> _______________________________________________
>> pkix mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
>
>
> _______________________________________________
> pkix mailing list [e-mail]
> To unsubscribe send an email [e-mail]