Re: [lamps] Proposed charter update regarding clarifications

>
> I see this as a clarification that is correct but no necessarily needed,
> as direct encipherment is technically not possible with ec-keys.

Hi Hendrik,

I respectfully disagree that this is not needed. The existing language
doesn't make this technical impossibility clear enough to prevent
certificates with such key usage bits being seen in the real world. The
more certificates with such nonsense KU's are produced the more likely it
will be that other systems begin to special case this phenomenon,
increasing complexity and the chance for more significant errors.

If you chase the links through the zlint PR[0] I wrote that Ryan referenced
earlier in thread you'll find your way to a Bugzilla bug[1] that references
~30 certificates issued by a trusted CA that contain the technically
impossible KU in question (here's one example[2]). My experience within the
larger web PKI ecosystem suggests to me this could be just the tip of the
iceberg.

I deeply sympathize with Stephen's appeal to not produce more useless paper
but the update to RFC 5480 won't fall into this category. An update to RFC
5480 will both clarify a point that is causing demonstrated confusion for
implementors and make it easier for the web PKI community to forbid the
practice with haste.

[0]: https://github.com/zmap/zlint/pull/293
[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1560234
[2]: https://crt.sh/?id=741149075

On Tue, Jul 30, 2019 at 8:38 AM Brockhaus, Hendrik <
hendrik.brockhaus@siemens.com> wrote:

> I see this as a clarification that is correct but no necessarily needed,
> as direct encipherment is technically not possible with ec-keys.
> But it may be helpful to have this more explicitly as currently specified.
>
> Hendrik
>
> > -----Ursprüngliche Nachricht-----
> > Von: Spasm <spasm-bounces@ietf.org> Im Auftrag von Russ Housley
> > Gesendet: Montag, 29. Juli 2019 16:22
> > An: Brockhaus, Hendrik (CT RDA CST SEA-DE)
> > <hendrik.brockhaus@siemens.com>
> > Cc: LAMPS WG <spasm@ietf.org>
> > Betreff: Re: [lamps] Proposed charter update regarding clarifications
> >
> > How does the update to RFC 5480 about key usage fit here?
> >
> > Russ
> >
> > > On Jul 29, 2019, at 8:13 AM, Brockhaus, Hendrik
> > <hendrik.brockhaus@siemens.com> wrote:
> > >
> > > I would be happy with the current text. But I guess there will be the
> need
> > for many updates at least with regard to support of upcoming crypto
> > algorithms. Therefore the new text will ease the processes.
> > > Finally it will be a trade-off between administrative overhead vs.
> risk of
> > 'pointless paper'. Finally I am with Stephen, that nothing should be done
> > without people willing to implement it.
> > >
> > > Hendrik
> > >
> > >> -----Ursprüngliche Nachricht-----
> > >> Von: Spasm <spasm-bounces@ietf.org> Im Auftrag von Russ Housley
> > >> Gesendet: Samstag, 27. Juli 2019 13:40
> > >> An: LAMPS WG <spasm@ietf.org>
> > >> Betreff: [lamps] Proposed charter update regarding clarifications
> > >>
> > >> At the meeting in Montreal, we suggested a charter update to allow
> > >> clarifications.  I suggest:
> > >>
> > >> OLD:
> > >>
> > >> In addition, the LAMPS WG may investigate other updates to documents
> > >> produced by the PKIX and S/MIME WGs, but the LAMPS WG shall not
> > adopt
> > >> any of these potential work items without rechartering.
> > >>
> > >> NEW:
> > >>
> > >> In addition, the LAMPS WG may investigate other updates to documents
> > >> produced by the PKIX and S/MIME WG. The LAMPS WG may produce
> > >> clarifications where needed, but the LAMPS WG shall not adopt
> > >> anything beyond clarifications without rechartering.
> > >>
> > >> Thoughts?
> > >>
> > >> Russ
> > >> _______________________________________________
> > >> Spasm mailing list
> > >> Spasm@ietf.org
> > >> https://www
> > >>
> > .ietf.org%2Fmailman%2Flistinfo%2Fspasm&amp;data=02%7C01%7Chendrik.
> > >>
> > brockhaus%40siemens.com%7C28e8b2e7640e486105ab08d712873521%7C38
> > >>
> > ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C636998244239259100&am
> > >>
> > p;sdata=5wTBzw09KsNOVU%2FOZAIi94fIzXu2UZ%2Bm%2B12sIf%2FRS4w%3
> > >> D&amp;reserved=0
> > >
> > > _______________________________________________
> > > Spasm mailing list
> > > Spasm@ietf.org
> > >
> > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> > .
> > >
> > ietf.org%2Fmailman%2Flistinfo%2Fspasm&amp;data=02%7C01%7Chendrik.b
> > rock
> > >
> > haus%40siemens.com%7C6192e50f83614e861f7208d714303717%7C38ae3bcd
> > 95794f
> > >
> > d4addab42e1495d55a%7C1%7C0%7C637000069621473442&amp;sdata=X5Kto
> > 6cOEfFt
> > > lPEfePsHx23ouMD7dKXRpP5JeBfqhnw%3D&amp;reserved=0
> >
> > _______________________________________________
> > Spasm mailing list
> > Spasm@ietf.org
> > https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww
> > .ietf.org%2Fmailman%2Flistinfo%2Fspasm&amp;data=02%7C01%7Chendrik.
> > brockhaus%40siemens.com%7C6192e50f83614e861f7208d714303717%7C38a
> > e3bcd95794fd4addab42e1495d55a%7C1%7C0%7C637000069621473442&amp;
> > sdata=X5Kto6cOEfFtlPEfePsHx23ouMD7dKXRpP5JeBfqhnw%3D&amp;reserv
> > ed=0
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>