Subject: Mini report on X.509 mtg last week

From: Sharon Boeyen <[email-masked]>
Date: Fri, 31 Mar 2000 10:27:29 -0500

As many of you know, the part of ITU-T that X.509 is under met last week.
The editorial corrections (most of them correcting invalid asn.1) and defect
resolutions were all accepted and a few more editorial fixes identified
(e.g. pointers to deleted annexes etc.). The corrected revised
Recommendation X.509 was sent to ITU yesterday. Formal approval is expected
today by ITU-T. Pre-publication is expected by ITU within a couple of weeks,
so this will formally be known as X.509 (2000). You probably remember that
this includes a complete restructuring of the content of 509, hopefully
making it much better organized and easier to read or find items of
interest. Note also that the title has been changed from "Authentication
Framework" to "Public-Key and Attribute Certificate Frameworks". 

Specifc items some of you may be interested in:

- the ASN.1 syntax of the targeting information extension was modified. This
was done 
  in close collaboration with the editors of the PKIX profile of X.509 for
attribute 
  certs. It seems that while both had the extension (and the intention was
always for 
  aligned syntax) they had managed to diverge. It is my understanding that
PKIX syntax 
  is also being modified and we have a single syntax that meets all stated
requirements.

- the ASN.1 syntax for attribute descriptor extension was modified. The
syntax that was 
  in the earlier draft was invalid asn.1 and didn't actually do what was
intended
  anyway.

- the ASN.1 of the AttCertIssuer construct was modified. While it was always
the intent
  to maintain backward compatibility with v1 attribute certificate format,
an error had 
  crept in and we needed to fix that to retain backward compatibility.

- some precision was added to the ASN.1 for the crossCertificatePair
construct (WITH 
  COMPONENTS statements) to ensure that something be present in the
attribute.

- some clarifications were added, including:
  a)interpretation of the subjectKeyIDRange DER
  b) recommending that if no certs have been revoked,the revokedCertificates

     parameter be omitted from a CRL 
     (rather than being included with an empty SEQUENCE)
  c) clarifying that attribute certificates do not ALWAYS point to a
specific 
     public-key certificate
  d) clarifying the actions to be taken with user notices in attribute
certs.

The changes made in the 2000 text as a result of Defect Reports registered
against 
the 1997 edition include:

- The DTCs that were balloted by ISO last year (1,3,4,5 and 7) are all
reflected 
  in this text. There were some comments received from US, Canada and Japan.
All 
  comments were accepted and are reflected as well. If anyone wants to see
the 
  DTCs themselves, Hoyt still has them available on his server. Note that
although 
  the comment from Japan was accepted (resulting in rejection of Defect
Report 219 
  against the 97 edition) the change proposed in the Defect Report was
accepted 
  for the 2000 text and is reflected in this document. 

- A couple of new defect reports have been registered against the 97 edition
(DR
  226, 227 and 240). These DRs and the associated DTCs are either available
now 
  or will be shortly on Hoyt's server. One deals with deletion of a sentence
that 
  used to require all cert certificate production to occur offline, another
is 
  with respect to the two mechanisms for authority key identifiers and the
3rd 
  is a number of typographical corrections to the ASN.1 in Annex A. The 3rd
is
  irrelevant for the 2000 edition, but the first two are relevant. The
offending 
  sentence (about offline production only) was deleted. The authority key
identifier 
  issue was addressed by adding text that clarifies that keyIdentifier can
be used 
  to select CA certificates during path construction while
authorityCertIssuer, 
  authoritySerialNumber pair can only be used to provide preference to one
certificate
  over others during path construction. Rather than deprecate the latter
mechanism 
  in X.509 itself, it was agreed that this was better left for profiling
groups to 
  determine.

X.509 requirements that resulted in changes to other Recommendations:

- In response to the liaison statement received from IETF, the text that
describes
  serialNumber in X.520 was modified with "device" being changed to "object"
in 
  the Draft Amendment to be approved today by ITU-T for the new edition. A
Defect 
  Report was also registered (DR 241) to make this same change retroactively
to the 
  1997 edition of X.520. This is included in a new DTC to be balloted.

- Because the definition of the crlDistributionPoints attribute was added
directly 
  to X.509, the duplicate definition is being deleted from X.521.  

This is, from the ITU perspective, the closure of the 2000 edition for
X.509. ISO still 
has the Final DAM ballot (a 2 month ballot with no technical comments
basically) to conduct. ITU-T will pre-publish the text very shortly, to be
followed by final publication following the ISO ballot. The final draft that
is available on Hoyt's server has been converted to North American paper
size. For those who haven't seen his email sent to PKIX and the directory
list, here are the pointers:
ftp://ftp.bull.com/pub/OSIdirectory/4thEditionTexts/X.509_4thEditionDraft.do
c

ftp://ftp.bull.com/pub/OSIdirectory/4thEditionTexts/X.509_4thEditionDraft.pd
f

I have the original A4 paper version and asked Hoyt to post that as well. If
anyone needs that version prior to Hoyt posting it, let me know and I can
email it to you. In terms of future work for X.509 itself, I'm hoping it
will be basically maintenance work only - always the potential for defect
reports I suppose :-( . The door has been left open, however, should any new
requirements emerge for X.509 itself as a result of the new work in many
other forums (e.g. should the WAP work require any 509 modifications). I
don't believe any specific items have been identified, but just in case ... 

Finally, I really want to thank EVERYONE who took the time to proof the
editors drafts. This really helped me catch a number of errors in the text
and reduce the number of 
future defect reports. Special thanks to those who ran the modules through
asn.1 compilers (Erik Andersen, Olivier Dubuisson, Phil Griffin and Sandy
Shaw), and to the editors of the PKIX attribute certificate profile for
catching a couple of "gotchas" (Steve Farrell and Russ Housley).

Any specific questions, feel free to send them by email directly to me.     

Sharon Boeyen
Entrust Technologies
[email-masked]