Subject: Re: [pkix] RFC 3161 ref: RFC 2630 obsoleted by 3852 ?

From: "Pope, Nick" <[email-masked]>
Date: Mon, 21 Sep 2009 16:51:07 +0100

OK thanks.

I believe that it the following updated statement is a reasonable: 

"RFC 3161 conformant systems can use RFC 5652 or other versions of CMS
subsequent to RFC 2630."

Nick

> >
> > a) RFC 3161 is being updated (rather than superseded) to support
> ESSCertV2
> > to enable use of more modern hash algorithms instead of SHA-1
> >
> > b) Similarly, the use of RFC 3852 instead of RFC 2630 does not require
> > support for old hash algorithms
> >
> > c) Similarly, the use of RFC 3852 recognises use of other newer forms of
> > signature attributes such as AttributeCertificatev2 instead of older
> > certificate formats.

> -----Original Message-----
> From: Sean Turner [mailto:[email-masked]]
> Sent: 21 September 2009 16:39
> To: Pope, Nick
> Cc: 'pkix '; 'Stefan Santesson'
> Subject: Re: [pkix] RFC 3161 ref: RFC 2630 obsoleted by 3852 ?
> 
> Nick,
> 
> Note that RFC 3852 was recently obsoleted by RFC 5652.
> 
> spt
> 
> Pope, Nick wrote:
> > Stefan and I have made enquiries with the area directors regarding how
> > obsolete RFCs are handled, in particular whether systems conformant to
> RFC
> > 3161 can used RFC 3852 instead of RFC 2630 so that:
> >
> >  a) Old hash algorithms, in this case SHA-1, do not need to be
> supported.
> >  b) Newer forms of attribute (AttributeCertv2) certificate can be used
> >
> > It appears there are no hard rules on this and in fact:
> >
> > "the rules are *intentionally* unclear -- if a reference has been
> obsoleted,
> > it varies from case to case whether the reader should read the old one
> or
> > the new one."
> >
> > However, I believe that it is reasonable that RFC 3161 conformant
> systems
> > can use RFC 3852 instead of RFC 2630, given that:
> >
> > a) RFC 3161 is being updated (rather than superseded) to support
> ESSCertV2
> > to enable use of more modern hash algorithms instead of SHA-1
> >
> > b) Similarly, the use of RFC 3852 instead of RFC 2630 does not require
> > support for old hash algorithms
> >
> > c) Similarly, the use of RFC 3852 recognises use of other newer forms of
> > signature attributes such as AttributeCertificatev2 instead of older
> > certificate formats.
> >
> > I leave it up to the group whether this statement to the list (assuming
> > there is no disagreement) makes it clear enough to implementers or
> whether a
> > new RFC is needed.
> >
> > Nick
> >
> >
> >
> > Consider the environment before printing this mail.
> > "Thales e-Security Limited is incorporated in England and Wales with
> company
> > registration number 2518805. Its registered office is located at 2
> Dashwood
> > Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey
> KT15
> > 2NX.
> > The information contained in this e-mail is confidential. It may also be
> > privileged. It is only intended for the stated addressee(s) and access
> to it
> > by any other person is unauthorised. If you are not an addressee or the
> > intended addressee, you must not disclose, copy, circulate or in any
> other
> > way use or rely on the information contained in this e-mail. Such
> > unauthorised use may be unlawful. If you have received this e-mail in
> error
> > please delete it (and all copies) from your system, please also inform
> us
> > immediately on +44 (0)1844 201800 or email postmaster@thales-
> esecurity.com.
> > Commercial matters detailed or referred to in this e-mail are subject to
> a
> > written contract signed for and on behalf of Thales e-Security Limited".
> > _______________________________________________
> > pkix mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/pkix
> >
Consider the environment before printing this mail.
"Thales e-Security Limited is incorporated in England and Wales with company
registration number 2518805. Its registered office is located at 2 Dashwood
Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey KT15
2NX.
The information contained in this e-mail is confidential. It may also be
privileged. It is only intended for the stated addressee(s) and access to it
by any other person is unauthorised. If you are not an addressee or the
intended addressee, you must not disclose, copy, circulate or in any other
way use or rely on the information contained in this e-mail. Such
unauthorised use may be unlawful. If you have received this e-mail in error
please delete it (and all copies) from your system, please also inform us
immediately on +44 (0)1844 201800 or email [email-masked].
Commercial matters detailed or referred to in this e-mail are subject to a
written contract signed for and on behalf of Thales e-Security Limited".