Subject: [pkix] [Technical Errata Reported] RFC2560 (3417)

From: RFC Errata System <[email-masked]>
Date: Mon, 26 Nov 2012 05:12:23 -0800 (PST)

The following errata report has been submitted for RFC2560,
"X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=2560&eid=3417

--------------------------------------
Type: Technical
Reported by: John Soltes <[email-masked]>

Section: 4.2.2.2

Original Text
-------------
...OCSP signing delegation SHALL be designated by the
   inclusion of id-kp-OCSPSigning in an extendedKeyUsage certificate
   extension included in the OCSP response signer's certificate.  This
   certificate MUST be issued directly by the CA that issued the
   certificate in question.

   id-kp-OCSPSigning OBJECT IDENTIFIER ::= {id-kp 9}

   Systems or applications that rely on OCSP responses MUST be capable
   of detecting and enforcing use of the id-ad-ocspSigning value as
   described above...They MUST reject the
   response if the certificate required to validate the signature on the
   response fails to meet at least one of the following criteria:

   ...

   3. Includes a value of id-ad-ocspSigning in an ExtendedKeyUsage
   extension and is issued by the CA that issued the certificate in
   question."

Corrected Text
--------------
...OCSP signing delegation SHALL be designated by the
   inclusion of id-kp-OCSPSigning in an extendedKeyUsage certificate
   extension included in the OCSP response signer's certificate.  This
   certificate MUST be issued directly by the CA that issued the
   certificate in question.

   id-kp-OCSPSigning OBJECT IDENTIFIER ::= {id-kp 9}

   Systems or applications that rely on OCSP responses MUST be capable
   of detecting and enforcing use of the id-kp-OCSPSigning value as
   described above...They MUST reject the
   response if the certificate required to validate the signature on the
   response fails to meet at least one of the following criteria:

   ...

   3. Includes a value of id-kp-OCSPSigning in an ExtendedKeyUsage
   extension and is issued by the CA that issued the certificate in
   question.

Notes
-----
The first paragraph specifies that an "id-kp-OCSPSigning" value be included, and it then defines that value as "id-kp-OCSPSigning OBJECT IDENTIFIER ::= {id-kp 9}", yet the second paragraph and the third listed alternative specify the use of an "id-ad-ocspSigning" value, which is not defined. I assume that "id-kp-OCSPSigning" should be used throughout? Also, the double quote mark at the end of the third listed alternative should be removed.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC2560 (draft-ietf-pkix-ocsp-07)
--------------------------------------
Title               : X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Publication Date    : June 1999
Author(s)           : M. Myers, R. Ankney, A. Malpani, S. Galperin, C. Adams
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Stefan Santesson <[email-masked]>
Date: Mon, 26 Nov 2012 14:59:00 +0100

Good catch in this errata.

It's almost amazing that this has gone unnoticed for all these years :)
I have updated this in the coming draft 2560bis

/Stefan

On 11/26/12 2:12 PM, "RFC Errata System" <[email-masked]> wrote:

>The first paragraph specifies that an "id-kp-OCSPSigning" value be
>included, and it then defines that value as "id-kp-OCSPSigning OBJECT
>IDENTIFIER ::= {id-kp 9}", yet the second paragraph and the third listed
>alternative specify the use of an "id-ad-ocspSigning" value, which is not
>defined. I assume that "id-kp-OCSPSigning" should be used throughout?
>Also, the double quote mark at the end of the third listed alternative
>should be removed.
>
>Instructions:
>-------------
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 26 Nov 2012 11:03:36 -0500

It was actually noticed and corrected more than ten years ago (see 
Appendix D in 
http://tools.ietf.org/html/draft-ietf-pkix-rfc2560bis-00).  The error 
just got reintroduced in draft -05 of 2560bis.

On 11/26/2012 08:59 AM, Stefan Santesson wrote:
> .

---

From: Sean Turner <[email-masked]>
Date: Mon, 26 Nov 2012 15:56:28 -0500

I was thinking along the same lines as David.  I'm going to accept this 
errata, but I'm going to:

1. Change it to editorial.  This just seems to me like a typo.

2. Edit it down a bit:

OLD:

described above.

NEW:

described above.

3. and put the bit about the " in the notes.

spt

---

From: Sean Turner <[email-masked]>
Date: Mon, 26 Nov 2012 19:02:33 -0500

Thanks I'll get that fixed.

spt

On 11/26/12 4:01 PM, Soltes, John W (John) wrote:
> Your change missed one of the typos.
> You also need to make the following change:
>
> OLD:
>      3. Includes a value of id-ad-ocspSigning in an ExtendedKeyUsage...
>
> NEW:
>      3. Includes a value of id-kp-OCSPSigning in an ExtendedKeyUsage...
>
> John
>
> -----Original Message-----
> From: Sean Turner [mailto:[email-masked]]
> Sent: Monday, November 26, 2012 3:56 PM
> To: [email-masked]
> Cc: Stefan Santesson; Soltes, John W (John)
> Subject: Re: [pkix] [Technical Errata Reported] RFC2560 (3417)
>

---

From: "Soltes, John W (John)" <[email-masked]>
Date: Mon, 26 Nov 2012 21:01:57 +0000

OLD:

NEW:

John

-----Original Message-----
From: Sean Turner [mailto:[email-masked]] 
Sent: Monday, November 26, 2012 3:56 PM
To: [email-masked]
Cc: Stefan Santesson; Soltes, John W (John)
Subject: Re: [pkix] [Technical Errata Reported] RFC2560 (3417)

2. Edit it down a bit:

OLD:

NEW:

spt