Subject: [pkix] [Technical Errata Reported] RFC6960 (6166)

From: RFC Errata System <[email-masked]>
Date: Mon, 11 May 2020 05:19:27 -0700 (PDT)

The following errata report has been submitted for RFC6960,
"X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6166

--------------------------------------
Type: Technical
Reported by: Yury Strozhevsky <[email-masked]>

Section: Appendix B.2

Original Text
-------------
KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
                         -- (excluding the tag and length fields)

Corrected Text
--------------
KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
                         -- (i.e., the SHA-1 hash of the value of the
                         -- BIT STRING subjectPublicKey [excluding
                         -- the tag, length, and number of unused
                         -- bits] in the responder's certificate)

Notes
-----
These two descriptions of KeyHash produce different SHA-1 hashes due to different values: one is pure BIT STRING value block, with "unused bits" byte, but other - without "unused byte". Also the Appendix B.2 must be aligned with Appendix B.1 information.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6960 (draft-ietf-pkix-rfc2560bis-20)
--------------------------------------
Title               : X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Publication Date    : June 2013
Author(s)           : S. Santesson, M. Myers, R. Ankney, A. Malpani, S. Galperin, C. Adams
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG