[pkix] [Editorial Errata Reported] RFC3279 (6672)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 01 September 2021 01:41 UTC

To: rfc-editor@rfc-editor.org
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: hablutzel1@gmail.com, tim.polk@nist.gov, rhousley@rsasecurity.com, lbassham@nist.gov, pkix@ietf.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20210901014035.687A2F40772@rfc-editor.org>
Date: Tue, 31 Aug 2021 18:40:35 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/pkix/vLo8pTF5ioi34StRa3m9w2Vq-Ms>
Subject: [pkix] [Editorial Errata Reported] RFC3279 (6672)
Precedence: list

The following errata report has been submitted for RFC3279,
"Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6672

--------------------------------------
Type: Editorial
Reported by: Jaime Hablutzel <hablutzel1@gmail.com>

Section: 2.3.5

Original Text
-------------
If the keyUsage extension is present in a CA or CRL issuer certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation; and
keyAgreement.

If the keyAgreement value is present, either of the following values MAY be present:

encipherOnly; and
decipherOnly.

The keyUsage extension MUST NOT assert both encipherOnly and decipherOnly.

If the keyUsage extension is present in a CA certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation;
keyAgreement;
keyCertSign; and
cRLSign.

Corrected Text
--------------
If the keyUsage extension is present in an end entity certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation; and
keyAgreement.

If the keyAgreement value is present, either of the following values MAY be present:

encipherOnly; and
decipherOnly.

The keyUsage extension MUST NOT assert both encipherOnly and decipherOnly.

If the keyUsage extension is present in a CA or CRL issuer certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation;
keyAgreement;
keyCertSign; and
cRLSign.


Notes
-----
- "a CA or CRL issuer certificate" is replaced by "an end entity certificate"
- "CA certificate" is replaced by "CA or CRL issuer certificate"

The need for this correction can be confirmed from RFC 5480, "3. Key Usage Bits".

Corrected wording has been copied from the section "2.3.1 RSA Keys" of this RFC 3279 itself.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC3279 (draft-ietf-pkix-ipki-pkalgs-05)
--------------------------------------
Title               : Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Publication Date    : April 2002
Author(s)           : L. Bassham, W. Polk, R. Housley
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG

[pkix] [Editorial Errata Reported] RFC3279 (6672) RFC Errata System