Re: [sidr] [Technical Errata Reported] RFC6487 (3174)

[David Mandelberg <[e-mail]>]

On Wed, 2012-04-04 at 09:27 +1000, Geoff Huston wrote:
> I'm tending to a "reject". Section 4.8.3 does not precisely apply to CRLs, so to accept this would then require a further errata notice to amend this errata to narrow down the scope of the AIA further.

AKI, not AIA. I just meant that the CRL AKI should have the same format
and meaning as in 4.8.3, i.e. it should use the SHA-1 hash of the
issuer's public key with neither authorityCertIssuer nor
authorityCertSerialNumber fields present. Maybe the errata should be
rejected and resubmitted with text copied and edited from 4.8.3, instead
of referencing 4.8.3?


> Given that the text already says:  "The algorithm used in CRLs issued under this profile is specified in [RFC6485]." then I'm not not what futerhe specification is required here.

What part of RFC6485 says anything about CRL AKIs? The closest I can
find is in Section 2:

         NOTE: The exception to the above hashing algorithm is the use
         of SHA-1 [SHS] when Certification Authorities (CAs) generate
         authority and subject key identifiers [RFC6487].

That maybe could be interpreted as saying that CRL AKIs should use
SHA-1, but it doesn't say that authorityCertIssuer and
authorityCertSerialNumber must be absent. It also doesn't explicitly say
what to take the SHA-1 of when generating a CRL AKI.

-- 
David Mandelberg
Wed Apr 4 13:07:37 EDT 2012