Re: [smime] [Technical Errata Reported] RFC2634 (6562)
Russ Housley <housley@vigilsec.com> Wed, 28 April 2021 19:06 UTC
Return-Path: <housley@vigilsec.com>
X-Original-To: smime@ietfa.amsl.com
Delivered-To: smime@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBA4D3A1BB4 for <smime@ietfa.amsl.com>; Wed, 28 Apr 2021 12:06:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNKAxXbkZpNQ for <smime@ietfa.amsl.com>; Wed, 28 Apr 2021 12:06:42 -0700 (PDT)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25F283A1BB6 for <smime@ietf.org>; Wed, 28 Apr 2021 12:06:42 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id E6065300B9C for <smime@ietf.org>; Wed, 28 Apr 2021 15:06:39 -0400 (EDT)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id XkyvL_Fa2g9P for <smime@ietf.org>; Wed, 28 Apr 2021 15:06:33 -0400 (EDT)
Received: from a860b60074bd.fios-router.home (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id D478C300AE5; Wed, 28 Apr 2021 15:06:32 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.20\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <20210428180743.7B3D3F407B3@rfc-editor.org>
Date: Wed, 28 Apr 2021 15:06:32 -0400
Cc: David.von.Oheimb@siemens.com, IETF SMIME <smime@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <71F42520-97DE-4408-82DF-D2032C4696FB@vigilsec.com>
References: <20210428180743.7B3D3F407B3@rfc-editor.org>
To: "Roman D. Danyliw" <rdd@cert.org>, Ben Kaduk <kaduk@mit.edu>
X-Mailer: Apple Mail (2.3445.104.20)
Archived-At: <https://mailarchive.ietf.org/arch/msg/smime/-osXO7lkPzJlmm0mSymCz5DWees>
Subject: Re: [smime] [Technical Errata Reported] RFC2634 (6562)
X-BeenThere: smime@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: SMIME Working Group <smime.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/smime>, <mailto:smime-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/smime/>
List-Post: <mailto:smime@ietf.org>
List-Help: <mailto:smime-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/smime>, <mailto:smime-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Apr 2021 19:06:47 -0000
Roman and Ben: This was discussed on the mail list, and people agree that the proposed text adds clarity. I think that the MUST in the first sentence was implied, but others think otherwise. I recommend approving this one. Russ > On Apr 28, 2021, at 2:07 PM, RFC Errata System <rfc-editor@rfc-editor.org> wrote: > > The following errata report has been submitted for RFC2634, > "Enhanced Security Services for S/MIME". > > -------------------------------------- > You may review the report below and at: > https://www.rfc-editor.org/errata/eid6562 > > -------------------------------------- > Type: Technical > Reported by: David von Oheimb <David.von.Oheimb@siemens.com> > > Section: 5.4 > > Original Text > ------------- > The first certificate identified in the sequence of certificate > identifiers MUST be the certificate used to verify the signature. The > encoding of the ESSCertID for this certificate SHOULD include the > issuerSerial field. If other constraints ensure that > issuerAndSerialNumber will be present in the SignerInfo, the > issuerSerial field MAY be omitted. The certificate identified is used > during the signature verification process. If the hash of the > certificate does not match the certificate used to verify the > signature, the signature MUST be considered invalid. > > If more than one certificate is present in the sequence of > ESSCertIDs, the certificates after the first one limit the set of > authorization certificates that are used during signature validation. > > > Corrected Text > -------------- > The sequence of certificate identifiers MUST contain at least one element. > The first certificate identified MUST be the certificate used to verify the signature. > The encoding of the ESSCertID for this certificate SHOULD include the > issuerSerial field. If other constraints ensure that > issuerAndSerialNumber will be present in the SignerInfo, the > issuerSerial field MAY be omitted. The certificate identified is used > during the signature verification process. If the hash of the > certificate does not match the certificate used to verify the > signature, the signature MUST be considered invalid. > > If more than one certificate identifier is present in the sequence of ESSCertIDs, > all certificates referenced there MUST be part of the signature validation chain. > > > Notes > ----- > Some aspects of the 'certs' field of a SigningCertificate attribute: > > SigningCertificate ::= SEQUENCE { > certs SEQUENCE OF ESSCertID, > policies SEQUENCE OF PolicyInformation OPTIONAL > } > > described in the sentences quoted above are very vague. > This lead to major confusion and wrong implementations. > As meanwhile has been clarified, they should be re-phrased; > see suggested new version above. > > (One may further mandate/clarify that the certificate identifiers must be given in the same order > as they are expected in the validation chain, but I think this is not important because > the order should not play a critical role and will be determined by the validation chain anyway.) > > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party > can log in to change the status and edit the report, if necessary. > > -------------------------------------- > RFC2634 (draft-ietf-smime-ess-12) > -------------------------------------- > Title : Enhanced Security Services for S/MIME > Publication Date : June 1999 > Author(s) : P. Hoffman, Ed. > Category : PROPOSED STANDARD > Source : S/MIME Mail Security > Area : Security > Stream : IETF > Verifying Party : IESG > > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime
- [smime] [Technical Errata Reported] RFC2634 (6562) RFC Errata System
- Re: [smime] [Technical Errata Reported] RFC2634 (… Russ Housley