Subject: [Technical Errata Reported] RFC5280 (1774)

From: RFC Errata System <[email-masked]>
Date: Mon, 4 May 2009 11:28:00 -0700 (PDT)

The following errata report has been submitted for RFC5280,
"Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=5280&eid=1774

--------------------------------------
Type: Technical
Reported by: Takashi Ito <[email-masked]>

Section: 6.3

Original Text
-------------
   For each distribution point (DP) in the certificate CRL distribution
   points extension, for each corresponding CRL in the local CRL cache,
   while ((reasons_mask is not all-reasons) and (cert_status is
   UNREVOKED)) perform the following:

      (a)  Update the local CRL cache by obtaining a complete CRL, a
      delta CRL, or both, as required:

Corrected Text
--------------
   For each distribution point (DP) in the certificate CRL distribution
   points extension, for each corresponding CRL in the local CRL cache,
   while ((reasons_mask is not all-reasons) and (cert_status is
   UNREVOKED)) perform the following:

   (l)  Set the reasons_mask state variable to the union of
        its previous value and the value of the interim_reasons_mask
        state variable.

      (a)  Update the local CRL cache by obtaining a complete CRL, a
      delta CRL, or both, as required:

Notes
-----
This was reported in 2002 for RFC 3280, which this document obsoletes.  The correction did not make it in to RFC 5280, and therefore applies to RFC 5280 as well.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5280 (draft-ietf-pkix-rfc3280bis-11)
--------------------------------------
Title               : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Publication Date    : May 2008
Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. Housley, W. Polk
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 04 May 2009 15:03:12 -0400

I believe that this errata should be rejected as the correction already 
appears in RFC 5280 as step (1) in Section 6.3.3.

In the proposed errata, the step is labeled (l) but appears before step 
(a), which places it as the first step in the loop rather than the final 
step in the loop.  This step must appear as the final step since the 
union cannot be computed until after the interim_reasons_mask is 
computed.  Successful completion of the algorithm would also require 
running through the loop using a new distribution point after the 
revocation status had been determined just to update the reasons_mask.

So, while the errata against RFC 3280 correctly noted that a step was 
missing, the step was incorrectly placed at the beginning rather than 
the end of the loop.  RFC 5280 includes the step from the errata at the 
correct place in the algorithm.

Dave