Re: [rfc-i] RECOMMENDS

[Michael Richardson <[e-mail]>]

Hmm.
I'm responsible for the RFC8995 use of RECOMMENDS, in it's full context is:

   Sections 7.2.13 (2009 edition) and 8.10.3 (2018 edition) of [IDevID]
   discuss keyUsage and extendedKeyUsage extensions in the IDevID
   certificate.  [IDevID] acknowledges that adding restrictions in the
   certificate limits applicability of these long-lived certificates.
   This specification emphasizes this point and therefore RECOMMENDS
   that no key usage restrictions be included.  This is consistent with
   [RFC5280], Section 4.2.1.3, which does not require key usage
   restrictions for end-entity certificates.

in the list that Brian posted, it seems to be the youngest use :-)

We could have worded it:
   This specification emphasizes this point and therefore it is RECOMMENDED
   that no key usage restrictions be included.  This is consistent with

There definitely ought to be an "or else" for each SHOULD, and the "or else"
here is that it likely will fail to interoperate with anything that is
enforcing EKU.  In our case, that is actually what the IDevID document(s)
say, so we avoided repeating ourself, and I think that's okay.
Using "SHOULD NOT" we could have written:

   This specification emphasizes this point and key usage restrictions SHOULD
   NOT be included.  This is consistent with...

I think that these revisions would have been just fine.
I mostly agree with a few people (who unicasted me) that "it's all fine"

Where I agree with Brian: "grep" and non-english speakers who wonder if there
is some difference.  And the XML/HTML markup needs fixing.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide