Subject: [sidr] extensions in RFC6487 but not draft-ietf-sidr-bgpsec-pki-profiles-10

From: David Mandelberg <[email-masked]>
Date: Tue, 02 Jun 2015 13:32:52 -0400

Hi,

There's some text in draft-ietf-sidr-bgpsec-pki-profiles-10 sections 
3.1 and 3.1.3 that I found confusing. For reference,

https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles-10#section-3.1:

    This profile is also based on [RFC6487] and
    only the differences between this profile and the profile in
    [RFC6487] are listed.

https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles-10#section-3.1.3:

    The following X.509 V3 extensions MUST be present (or MUST be 
absent,
    if so stated) in a conforming BGPSEC Router Certificate, except 
where
    explicitly noted otherwise.  No other extensions are allowed in a
    conforming BGPSEC Router Certificate.

I checked with the authors, and the intent was that "the following" 
refers to all extensions in RFC6487 and the updates to extensions in 
draft-ietf-sidr-bgpsec-pki-profiles-10. However, I initially read the 
text in 3.1.3 as forbidding all extensions not mentioned in 
draft-ietf-sidr-bgpsec-pki-profiles-10, including some useful ones like 
the SKI.

I think it might be clearer to simply remove the entire first paragraph 
of section 3.1.3. RFC 6487 section 4.8 contains similar[0] text, and 
section 3.1 of the draft makes it clear that RFC 6487 section 4.8 
applies.

  [0] But not the same. That issue should probably be handled by 
draft-rhansen-sidr-rfc6487bis though.

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/

---

From: Sean Turner <[email-masked]>
Date: Fri, 12 Jun 2015 09:12:58 -0400

Not seeing any objections I’ll go ahead and spin a new version over the weekend.

spt

On Jun 02, 2015, at 13:32, David Mandelberg <[email-masked]> wrote:

> Hi,
> 
> There's some text in draft-ietf-sidr-bgpsec-pki-profiles-10 sections 3.1 and 3.1.3 that I found confusing. For reference,
> 
>   The following X.509 V3 extensions MUST be present (or MUST be absent,
>   if so stated) in a conforming BGPSEC Router Certificate, except where
> I checked with the authors, and the intent was that "the following" refers to all extensions in RFC6487 and the updates to extensions in draft-ietf-sidr-bgpsec-pki-profiles-10. However, I initially read the text in 3.1.3 as forbidding all extensions not mentioned in draft-ietf-sidr-bgpsec-pki-profiles-10, including some useful ones like the SKI.
> 
> I think it might be clearer to simply remove the entire first paragraph of section 3.1.3. RFC 6487 section 4.8 contains similar[0] text, and section 3.1 of the draft makes it clear that RFC 6487 section 4.8 applies.
> 
> [0] But not the same. That issue should probably be handled by draft-rhansen-sidr-rfc6487bis though.
> 
> -- 
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr