Subject: Question about the edition of RFC 3280

From: Denis Pinkas <[email-masked]>
Date: Mon, 07 Apr 2003 10:12:10 +0200

Dear web editor,

An e-mail from the RFC editor dated from May 10, 2002 states:

===================================================================

A new Request for Comments is now available in online RFC libraries.

         RFC 3280

         Title:      Internet X.509 Public Key Infrastructure
                     Certificate and Certificate Revocation List (CRL)
                     Profile
         Author(s):  R. Housley, W. Polk, W. Ford, D. Solo
         Status:     Standards Track
         Date:       April 2002
         Mailbox:    [email-masked], [email-masked],
                     [email-masked], [email-masked]
         Pages:      129
         Characters: 295556
         Updates/Obsoletes/SeeAlso:    None

         I-D Tag:    draft-ietf-pkix-new-part1-12.txt

====================================================================

The text that was draft-ietf-pkix-new-part1-12.txt is the following:

       "The digitalSignature bit is asserted when the subject public key
       is used with a digital signature mechanism to support security
       services other than non-repudiation (bit 1), certificate signing
       (bit 5), or CRL signing (bit 6).  Digital signature mechanisms are
       often used for entity authentication and data origin
       authentication with integrity."

while the text that is in RFC 3280 is the following:

       "The digitalSignature bit is asserted when the subject public key
       is used with a digital signature mechanism to support security
       services other than certificate signing (bit 5), or CRL signing
       (bit 6).  Digital signature mechanisms are often used for entity
       authentication and data origin authentication with integrity."

I would like to know, how/when such a change happened.

Thanks,

Denis

---

From: Russ Housley <[email-masked]>
Date: Mon, 07 Apr 2003 11:17:11 -0400

I do not know why you are asking about a change that happened a year ago, 
but here is the history.  This took quite a bit of time to pull together, 
and it involved searching the archives kept by several different individuals.

During IETF Last Call, the authors received a comment regarding the key 
usage bits.  We have been unsuccessful in locating this email message, so 
you will have to live with the personal recollection of the content of this 
message.  The comment stated that section 4.2.1.3 contained an 
inconsistency.  The comment pointed to the following text from 
draft-ietf-pkix-new-part1-12.txt:

       The digitalSignature bit is asserted when the subject public key
       is used with a digital signature mechanism to support security
       services other than non-repudiation (bit 1), certificate signing
       (bit 5), or CRL signing (bit 6).  Digital signature mechanisms are
       often used for entity authentication and data origin
       authentication with integrity.

       The nonRepudiation bit is asserted when the subject public key is
       used to verify digital signatures used to provide a non-
       repudiation service which protects against the signing entity
       falsely denying some action, excluding certificate or CRL signing.
       In the case of later conflict, a reliable third party may
       determine the authenticity of the signed data.

       Further distinctions between the digitalSignature and
       nonRepudiation bits may be provided in specific certificate
       policies.

The crux of the comment was: When the digitalSignature bit is asserted, 
then the digital signature mechanism supports security services other than 
non-repudiation.  This means that there is no overlap between these two bit 
settings.  This is in conflict with the statement that policy can provide 
further distinction between digitalSignature and nonRepudiation.

In resolving this comment, the authors also considered the vast volumes of 
messages on the PKIX WG mail list regarding the disputed meaning of these 
bits.  Recall that the third paragraph was added as a result of that very 
long discussion.

The actual changes were made to the document by the RFC Editor, and the 
request of the authors and concurrence of the Security Area 
Director.  These changes were considered to be clarifications that resolved 
an internal inconsistency.

The following is the note from the authors to the RFC Editor:

>Date: Wed, 17 Apr 2002 14:57:50 -0400
>To: [email-masked]
>From: Russ Housley <[email-masked]>
>Subject: Re: draft-ietf-pkix-new-part1-12.txt
>Cc: [email-masked], [email-masked], [email-masked]
>
>Dear RFC Editor:
>
>Here are the changes that are needed for draft-ietf-pkix-new-part1-12.txt
>
>[snip]
>
>Section 4.2.1.3, 4th Paragraph: Drop "non-repudiation (bit 1)" from the
>1st sentence.  Otherwise it conflicts with the first and last paragraphs
>of the same section.
>
>OLD:
>
>    Bits in the KeyUsage type are used as follows:
>
>        The digitalSignature bit is asserted when the subject public key
>        authentication with integrity.
>
>NEW:
>
>     Bits in the KeyUsage type are used as follows:
>
>        The digitalSignature bit is asserted when the subject public key
>        authentication and data origin authentication with integrity.
>
>[snip]

In response to this request, the RFC Editor contacted the Security Area 
Directors to confirm that the changes were appropriate.  Jeff Schiller 
responded with the following message:

>Date: Wed, 17 Apr 2002 19:37:36 -0400
>From: "Jeffrey I. Schiller" <[email-masked]>
>To: [email-masked]
>Cc: [email-masked], [email-masked], [email-masked]
>Subject: Re: AD response request: Re: draft-ietf-pkix-new-part1-12.txt
>
>I have reviewed the changes and they look fine to me.
>
>                         -Jeff
>
>On Wed, Apr 17, 2002 at 10:18:22PM +0000, [email-masked] wrote:
> > Jeff and Steve,
> >
> > Could you please verify that the following changes are okay?  For the
> > most part, they seem editorial in nature, but we wanted to get an okay
> > from you guys as there are such a great number of changes.
> >
> > Thank you.
> >
> > RFC Editor

Denis, this is the history.  I think you can see that an appropriate 
comment resolution process was followed.  I am sure you have faced similar 
comments on documents that you have authored.

Russ

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 08 Apr 2003 12:10:31 +0200

Russ,

Thank you for this long-awaited answer.

Shortly speaking, the change that has been made cannot be considered as 
"editorial" and introduces an incompatibility with both RFC 2459 and X.509.

Peter Sylvester raised the following questions:

- Whether this reflects a discussion in the working group for which
   consensus had been achieved.

- how the consensus was achieved.

We can see that this change does not reflect a WG consensus and that the WG 
has been kept ignorant when the change was being made (and that the change 
was being made).

Furthermore, the comment that lead to that change has *not* been posted to 
the WG list. We cannot thus speak of a fair and open process.

See additional comments below.

> I do not know why you are asking about a change that happened a year 
> ago, but here is the history.  This took quite a bit of time to pull 
> together, and it involved searching the archives kept by several 
> different individuals.
> 
> usage bits.  We have been unsuccessful in locating this email message, 
> so you will have to live with the personal recollection of the content 
> of this message.  

It is quite strange that such a message has been lost by all the editors 
together. :-|

Unless someone from the WG mailing list remember that he posted this message 
and makes itself known, the reality of the existence of this message will be 
questionable.

Can anyone from the WG identifies himself as being the sender of the message 
that lead to that change ?

> The comment stated that section 4.2.1.3 contained an 
> then the digital signature mechanism supports security services other 
> than non-repudiation.  This means that there is no overlap between these 
> two bit settings.  This is in conflict with the statement that policy 
> can provide further distinction between digitalSignature and 
> nonRepudiation.

When the addition was discussed noone said that additional text neeeded to 
be changed.

If the person that sent the message saw a contradiction, then this issue 
should have at least advertised to the WG.

A simple way to solve this "contradiction" would have been to delete the 
addition.

As far as I am concerned, I interpreted the sentence by the fact that some 
certificate policies may refuse to issue certificates with the two bits set, 
while some others may accept. The exclusivity of bits 1 and 0 is not 
mandated, but is certainly a potentially very dangerous combination.

> In resolving this comment, the authors also considered the vast volumes 
> of messages on the PKIX WG mail list regarding the disputed meaning of 
> these bits.  Recall that the third paragraph was added as a result of 
> that very long discussion.

Since you mention that it was a disputed debate, any change to that section 
should have been brought back to the group.

> request of the authors and concurrence of the Security Area Director.  
> These changes were considered to be clarifications that resolved an 
> internal inconsistency.

I am sorry, but the change is well behind a "clarification" since it 
introduces a major change with the agreed document placed on the web server, 
i.e. version 12. Once a document is placed on the server, only real 
editorial changes can be done. This one cannot fall in this category.

> Denis, this is the history.  

We cannot change history, but we can now consider how to correct the situation.

> I think you can see that an appropriate comment resolution process was followed. 

I have to disagree with your statement.

 > I am sure you have faced similar comments on documents that you have
 > authored.

Up to now, I have not faced such a situation, and given that experience it 
is very unlikely that I will ever face it.

I am awaiting for proposals from yourself, the co-chairs and/or the Security 
Area Directors on the way to re-establish a backward compatibility with RFC 
2459.

Denis

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 08 Apr 2003 19:37:32 +0200

Denis,

At 12:10 2003-04-08 +0200, Denis Pinkas wrote:
>>you will have to live with the personal recollection of the content of 
>>this message.
>
>Unless someone from the WG mailing list remember that he posted this 
>message and makes itself known, the reality of the existence of this 
>message will be questionable.
>
>Can anyone from the WG identifies himself as being the sender of the 
>message that lead to that change ?

I identify myself as the originator of this mail and confirm that the 
aspect referred to by Russ was contained in my comment.

I was asked to find this mail as part of the reconstruction you have 
requested but was unable to do so due to a disk crash I suffered from last 
year where I lost lots of old e-mail.

/Stefan

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 10 Apr 2003 10:54:54 +0200

Stefan,

Thank you for the response.

I realize that very unfortunately both the sender of the message and the 
receivers of the message lost the message. :-|

Now, looking forward, I would like to make the following proposal:

Next week there is the RSA 2003 Security Conference. I will attend the 
Conference and I guess may other people from the PKIX WG will do so as well.

Since there is the speaker's dinner on the Tuesday and the Gala Dinner of 
the Wednesday, I propose to have an informal meeting about key usage bits 0 
and 1 on the Monday evening for anyone interrested.

I thus propose to meet in the North Lobby, in front of the registration 
desks at 5:30 p.m. on the Monday evening.

I would like to discuss the meaning of a certificate that has:

  1° only the key usage bit 1 set,
  2° only the key usage bit 0 set,
  3° both the key usage bits 0 and 1 set.

   ... when looking at the writing of RFC 2459 and
       when looking at the writing of RFC 3280.

Denis

Note: I blindly copy the OSI Security list, including Hoyt Kesterson who 
will be present at the Conference (and if he may join).

>>> During IETF Last Call, the authors received a comment regarding the 
>>> key usage bits.  We have been unsuccessful in locating this email 
>>> message, so you will have to live with the personal recollection of 
>>> the content of this message.
>>
>>
>> It is quite strange that such a message has been lost by all the 
>> editors together. :-|
>>
> requested but was unable to do so due to a disk crash I suffered from 
> last year where I lost lots of old e-mail.
> 
> /Stefan
> 
> 
> 
>

---

From: "Hoyt L. Kesterson II" <[email-masked]>
Date: Thu, 10 Apr 2003 02:08:03 -0700

more than willing to discuss this topic, especially 1 and 2.

i point out that the amendment had very clear text about the setting 
of multiple key usage bits and that there were no ballot comments on 
that point

    hoyt

At 10:54 AM +0200 4/10/03, Denis Pinkas wrote:
>I realize that very unfortunately both the sender of the message and 
>the receivers of the message lost the message. :-|
>
>Next week there is the RSA 2003 Security Conference. I will attend 
>the Conference and I guess may other people from the PKIX WG will do 
>so as well.
>
>Since there is the speaker's dinner on the Tuesday and the Gala 
>Dinner of the Wednesday, I propose to have an informal meeting about 
>key usage bits 0 and 1 on the Monday evening for anyone interrested.
>
>I thus propose to meet in the North Lobby, in front of the 
>registration desks at 5:30 p.m. on the Monday evening.
>
>Note: I blindly copy the OSI Security list, including Hoyt Kesterson 
>who will be present at the Conference (and if he may join).
>
>>Denis,
>>
>>>>I do not know why you are asking about a change that happened a 
>>>>year ago, but here is the history.  This took quite a bit of time 
>>>>to pull together, and it involved searching the archives kept by 
>>>>several different individuals.
>>>>During IETF Last Call, the authors received a comment regarding 
>>>>the key usage bits.  We have been unsuccessful in locating this 
>>>>email message, so you will have to live with the personal 
>>>>recollection of the content of this message.
>>>
>>>
>>>Unless someone from the WG mailing list remember that he posted 
>>>this message and makes itself known, the reality of the existence 
>>>of this message will be questionable.
>>>
>>>Can anyone from the WG identifies himself as being the sender of 
>>>the message that lead to that change ?
>>
>>
>>I identify myself as the originator of this mail and confirm that 
>>the aspect referred to by Russ was contained in my comment.
>>
>>I was asked to find this mail as part of the reconstruction you 
>>have requested but was unable to do so due to a disk crash I 
>>suffered from last year where I lost lots of old e-mail.
>>
>>/Stefan

---

From: Russ Housley <[email-masked]>
Date: Thu, 10 Apr 2003 13:02:58 -0400

Denis:

I would like to participate, but I already have a commitment for Monday 
evening.

Sorry,
   Russ

At 10:54 AM 4/10/2003 +0200, Denis Pinkas wrote:
>the Wednesday, I propose to have an informal meeting about key usage bits 
>0 and 1 on the Monday evening for anyone interrested.
>