Subject: draft-ietf-pkix-rfc3280bis-11.txt

From: "David A. Cooper" <[email-masked]>
Date: Tue, 05 Feb 2008 14:19:29 -0500

All,

Yesterday, I submitted draft -11 of 3280bis for posting.  This will, 
hopefully, be the final draft.

As usual, I have posted a diff file highlighting the changes between 
drafts -10 and -11: 
http://www.csrc.nist.gov/groups/ST/crypto_apps_infra/documents/draft3280bis-10todraft3280bis-11_diff.html.

1) Text added to clarify that extensions (extnValue in Extension) in 
must be DER encoded.

2) All references to "RFC 822 name" were replaced with "electronic mail 
address" or "rfc822Name", whichever was more appropriate.

3) All references to "addr-spec" from [RFC 2822] were replaced with 
references to "Mailbox" from section 4.1.2 of [RFC 2821].

4) Text was added to section 4.2.1.4 to provide further guidance on the 
use of the explicitText string from the userNotice policy qualifier:

   The explicitText string SHOULD NOT include any control
   characters (e.g., U+0000 to U+001F and U+007F to U+009F).  When
   the UTF8String encoding is used, all character sequences SHOULD be
   normalized according to Unicode normalization form C (NFC) [NFC].

5) Text was added to clarify that domain labels in DNS names that appear 
in the dNSName field of subjectAltName may begin with a digit, as is 
permitted by [RFC 1123].

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 5 Feb 2008 14:51:38 -0800

>hopefully, be the final draft.

Sorry, but there is a technical change that should be made to the 
differences you posted:

>4) Text was added to section 4.2.1.4 to provide further guidance on 
>the use of the explicitText string from the userNotice policy 
>qualifier:
>

If we want all text to be normalized, we want it for both UTFString 
*and* BMPString.

--Paul Hoffman, Director
--VPN Consortium

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Wed, 06 Feb 2008 09:53:06 +0100

Paul Hoffman wrote:
>> the use of the explicitText string from the userNotice policy qualifier:
>>
Would it not be better to simply deprecate BMPString ?
(as well as UniversalString if referenced somewhere)

---

From: Peter Sylvester <[email-masked]>
Date: Wed, 06 Feb 2008 11:35:48 +0100

TBSCertList  ::=  SEQUENCE  {
        version                 Version OPTIONAL,
                                     -- if present, MUST be v2
        signature               AlgorithmIdentifier,
        issuer                  Name,
        thisUpdate              Time,
        nextUpdate              Time OPTIONAL,
        revokedCertificates     SEQUENCE OF SEQUENCE  {
             userCertificate         CertificateSerialNumber,
             revocationDate          Time,
             crlEntryExtensions      Extensions OPTIONAL
                                           -- if present, MUST be v2
                                  }  OPTIONAL,
        crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
                                           -- if present, MUST be v2

should probably be 

TBSCertList  ::=  SEQUENCE  {
        version                 Version OPTIONAL,
                                     -- if present, MUST be v2
        signature               AlgorithmIdentifier,
        issuer                  Name,
        thisUpdate              Time,
        nextUpdate              Time OPTIONAL,
        revokedCertificates     SEQUENCE OF SEQUENCE  {
             userCertificate         CertificateSerialNumber,
             revocationDate          Time,
             crlEntryExtensions      Extensions OPTIONAL
                                 -- if present, version MUST be v2
                                  }  OPTIONAL,
        crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
                                 -- if present, version MUST be v2

                                  }

---

From: "David A. Cooper" <[email-masked]>
Date: Wed, 06 Feb 2008 09:01:21 -0500

> (as well as UniversalString if referenced somewhere)

UniversalString is not an option.  explicitText is of type DisplayText, 
which is defined as follows:

   DisplayText ::= CHOICE {
        ia5String        IA5String      (SIZE (1..200)),
        visibleString    VisibleString  (SIZE (1..200)),
        bmpString        BMPString      (SIZE (1..200)),
        utf8String       UTF8String     (SIZE (1..200)) }

BMPString and VisibleString are already deprecated.  Here is the entire 
paragraph from which the new text was quoted.

   An explicitText field includes the textual statement directly in
   the certificate.  The explicitText field is a string with a
   maximum size of 200 characters.  Conforming CAs SHOULD use the
   UTF8String encoding for explicitText, but MAY use IA5String.
   Conforming CAs MUST NOT encode explicitText as VisibleString or
   BMPString.  The explicitText string SHOULD NOT include any control
   characters (e.g., U+0000 to U+001F and U+007F to U+009F).  When
   the UTF8String encoding is used, all character sequences SHOULD be
   normalized according to Unicode normalization form C (NFC) [NFC].

The sentence stating that CAs MUST NOT use VisibleString or BMPString 
was added in draft -00 of 3280bis.

Dave

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 6 Feb 2008 07:38:31 -0800

At 9:53 AM +0100 2/6/08, Jean-Marc Desperrier wrote:
>>>4) Text was added to section 4.2.1.4 to provide further guidance 
>>>on the use of the explicitText string from the userNotice policy 
>>>qualifier:
>>>

No. Many people are just fine with BMPString, and it's pretty late in 
the process to make such a large change.

>(as well as UniversalString if referenced somewhere)

Ditto.

It is quite reasonable to try to make string changes in the next 
round, but there is likely to be a lot of disagreement on what to 
take out and why.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 6 Feb 2008 08:21:15 -0800

At 9:01 AM -0500 2/6/08, David A. Cooper wrote:
>BMPString and VisibleString are already deprecated.  Here is the 
>entire paragraph from which the new text was quoted.
>
>The sentence stating that CAs MUST NOT use VisibleString or 
>BMPString was added in draft -00 of 3280bis.

Whoops, sorry, missed that. No problem then.

(The really picky among us would say that you do not need to say 
"When the UTF8String encoding is used," because you can use NFC on 
pure ASCII text as a no-op, but that will cause some developers to 
pull in a full NFC library for nothing...)

--Paul Hoffman, Director
--VPN Consortium