Subject: [Acme] Short WGLC review of draft-ietf-acme-email-smime-13

From: "Salz, Rich" <[email-masked]>
Date: Thu, 10 Dec 2020 18:23:08 +0000

In order to address feedback that came up during AD and WGLC review, Alexey posted a new draft.
This link will show the differences: https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-acme-email-smime-13.txt

Summary is that it adds text about putting the right keyUsage extensions (signing, encryption) so that different keys/certs can be used for signing and encryption. It’s important to be able to have separate signing and encryption keys.

Please send feedback by the end of next week.  Thanks!

---

From: Russ Housley <[email-masked]>
Date: Thu, 10 Dec 2020 16:45:03 -0500

This makes sense to me.

Russ

> On Dec 10, 2020, at 1:23 PM, Salz, Rich <rsalz=[email-masked]> wrote:
> 
> This link will show the differences: https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-acme-email-smime-13.txt <https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-acme-email-smime-13.txt>
>

---

From: Fraser Tweedale <[email-masked]>
Date: Sun, 13 Dec 2020 15:16:22 +1000

> Please send feedback by the end of next week.  Thanks!

There is ambiguity in Section 3.3:

   In order to request signing only S/MIME certificate, the CSR MUST
   include the key usage extension with digitalSignature and/or
   nonRepudiation bits set.

This text does not imply that that other bits, including
keyEncipherment/keyAgreement, MUST NOT be set.  I would suggest
appending "and no other bits set", i.e.:

   In order to request signing only S/MIME certificate, the CSR MUST
   include the key usage extension with digitalSignature and/or
   nonRepudiation bits set, and no other bits set.

Similarly for the subsequent paragraph (which can be solved the same
way):

   In order to request encryption only S/MIME certificate, the CSR MUST
   include the key usage extension with keyEncipherment and/or
   keyAgreement bits set.

Thanks,
Fraser

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 13 Dec 2020 15:35:54 +0000

Fraser,

Thanks for these editorial  clarifications; they seem like good things to do!