Re: [pkix] [Technical Errata Reported] RFC5912 (3623)

Independent of limit, this should change to use CRLnumber type to
facilitate satisfying the requirement for a big integer.  The CRLNumber
type is used in the prose describing the extension, but not in its
definition.  It is used in the DeltaCRLIndicator definition.

On 5/16/13 12:01 PM, "Erwann Abalea" <eabalea@gmail.com> wrote:

>The certificate serialNumber is limited to [0 .. 256^20] in value.
>The CRLNumber is limited to [-256^20 .. 256^20], it's not said to be a
>positive integer.
>
>2013/5/16 Jim Schaad <jimsch@augustcellars.com>:
>> Reject
>>
>> The serial number MUST be a positive integer assigned by the CA to
>>    each certificate.
>>
>>
>>> -----Original Message-----
>>> From: RFC Errata System [mailto:rfc-editor@rfc-editor.org]
>>> Sent: Thursday, May 16, 2013 12:08 PM
>>> To: paul.hoffman@vpnc.org; jimsch@exmsft.com;
>>>stephen.farrell@cs.tcd.ie;
>>> turners@ieca.com; kent@bbn.com; stefan@aaa-sec.com
>>> Cc: carl@redhoundsoftware.com; pkix@ietf.org; rfc-editor@rfc-editor.org
>>> Subject: [Technical Errata Reported] RFC5912 (3623)
>>>
>>> The following errata report has been submitted for RFC5912, "New ASN.1
>>> Modules for the Public Key Infrastructure Using X.509 (PKIX)".
>>>
>>> --------------------------------------
>>> You may review the report below and at:
>>> http://www.rfc-editor.org/errata_search.php?rfc=5912&eid=3623
>>>
>>> --------------------------------------
>>> Type: Technical
>>> Reported by: Carl Wallace <carl@redhoundsoftware.com>
>>>
>>> Section: 14
>>>
>>> Original Text
>>> -------------
>>>    -- CRL number extension OID and syntax
>>>    ext-CRLNumber EXTENSION ::= {SYNTAX
>>>        INTEGER (0..MAX) IDENTIFIED BY id-ce-cRLNumber }
>>>    id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
>>>
>>>    CRLNumber ::= INTEGER (0..MAX)
>>>
>>> Corrected Text
>>> --------------
>>>    -- CRL number extension OID and syntax
>>>    CRLNumber ::= INTEGER
>>>
>>>    ext-CRLNumber EXTENSION ::= {SYNTAX
>>>        CRLNumber IDENTIFIED BY id-ce-cRLNumber }
>>>    id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
>>>
>>>
>>> Notes
>>> -----
>>> The CRLNumber extension was not defined to use the CRLNumber type.  The
>>> CRLNumber type uses MAX to limit the maximum value.  This limitation is
>>> inconsistent with section 5.2.3 and Appendix B, which allow CRLNumber
>>> values up to 20 octets in length.
>>>
>>> Instructions:
>>> -------------
>>> This errata is currently posted as "Reported". If necessary, please use
>> "Reply
>>> All" to discuss whether it should be verified or rejected. When a
>>>decision
>> is
>>> reached, the verifying party (IESG) can log in to change the status and
>> edit the
>>> report, if necessary.
>>>
>>> --------------------------------------
>>> RFC5912 (draft-ietf-pkix-new-asn1-08)
>>> --------------------------------------
>>> Title               : New ASN.1 Modules for the Public Key
>>>Infrastructure
>> Using
>>> X.509 (PKIX)
>>> Publication Date    : June 2010
>>> Author(s)           : P. Hoffman, J. Schaad
>>> Category            : INFORMATIONAL
>>> Source              : Public-Key Infrastructure (X.509)
>>> Area                : Security
>>> Stream              : IETF
>>> Verifying Party     : IESG
>>
>> _______________________________________________
>> pkix mailing list
>> pkix@ietf.org
>> https://www.ietf.org/mailman/listinfo/pkix
>
>
>
>--
>Erwann.
>_______________________________________________
>pkix mailing list
>pkix@ietf.org
>https://www.ietf.org/mailman/listinfo/pkix