Subject: [pkix] WGLC draft-ietf-pkix-rfc3161-update-03.txt

From: "Pope, Nick" <[email-masked]>
Date: Wed, 16 Sep 2009 13:22:21 +0100

Following on from the earlier discussion on (non-existence of) procedures
which specify how obsolete references impact on conformance.  Particularly,
it is unclear that an RFC 3161 conformant implementation may use newer
versions of referenced RFC where the existing version has been obsoleted by
a newer version.  This is a major concern where exacting conformance
requirements are placed on time-stamp providers.

I suggest therefore the following be added in front of the references:

"Note: where a reference is obsoleted, directly or indirectly, by a newer
version of the referenced RFC this newer version may be in its stead."

This avoids us having to re-issue RFC 3161 just so that those implementers
that need to meet exacting conformance requirements are clear on the
conformance requirements of RFC 3161 especially such as use of RFC 5280 in
place of RFC 2459.

Nick
Consider the environment before printing this mail.
"Thales e-Security Limited is incorporated in England and Wales with company
registration number 2518805. Its registered office is located at 2 Dashwood
Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey KT15
2NX.
The information contained in this e-mail is confidential. It may also be
privileged. It is only intended for the stated addressee(s) and access to it
by any other person is unauthorised. If you are not an addressee or the
intended addressee, you must not disclose, copy, circulate or in any other
way use or rely on the information contained in this e-mail. Such
unauthorised use may be unlawful. If you have received this e-mail in error
please delete it (and all copies) from your system, please also inform us
immediately on +44 (0)1844 201800 or email [email-masked].
Commercial matters detailed or referred to in this e-mail are subject to a
written contract signed for and on behalf of Thales e-Security Limited".

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 16 Sep 2009 15:21:59 +0200

Nick,

Could you be more specific and provide an example where there is a real
implementation problem caused by a reference to an RFC that has been
replaced?

Or is this just a matter of principles?

Do you mean that we should include this note in the ESSCertIDv2 update
draft?

Is there any relationship between the reference update you are concerned
about and the ESSCertIDv2 update?

I don't think there is any such relationship, else there would have been a
new reference provided in the ESSCertIDv2 draft and it would have been a non
issue. If there is no such relationship, then I think it is outside the
scope of this draft. I then read your proposal as a suggestion to make a
rfc3161bis rfc. 

I would like to obtains further guidance from our ADs here. What is the
correct course of action?

/Stefan

On 09-09-16 2:22 PM, "Pope, Nick" <[email-masked]> wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix