Subject: [Trans] [trans] #147 (rfc6962-bis): definition of mis-issuance, still!

From: "trans issue tracker" <[email-masked]>
Date: Tue, 22 Dec 2015 16:21:46 -0000

#147: definition of mis-issuance, still!

 6962-bis fais to define the term that is the cited motivation for CT. Rob
 changed my ticket (#71) to say that this was a task for the threat
 analysis doc, but it is a criticism of 6962-bis. The following text,
 extracted from the threat analysis document, should be added as a new,
 second paragraph in Section 1.

 In the context of Certificate Transparency (CT) certificate mis-issuance
 is defined to encompass violations of either semantic or syntactic
 constraints. The fundamental semantic constraint for a certificate is that
 it was issued to an entity that is authorized to represent the Subject (or
 Subject Alternative) named in the certificate. (It is also assumed that
 the entity requested the certificate from the CA that issued it.)

 A certificate is characterized as syntactically mis-issued if it violates
 syntax constraints associated with the class of certificate that it
 purports to represent. Syntax constraints for certificates are established
 by certificate profiles, and typically are application-specific. For
 example, certificates used in the Web PKI environment might be
 characterized as domain validation (DV) or extended validation (EV)
 certificates.  Certificates used with applications such as IPsec or S/MIME
 have different syntactic constraints from those in the Web PKI context.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-trans-
  [email-masked]           |  [email-masked]
     Type:  defect       |     Status:  new
 Priority:  major        |  Milestone:
Component:  rfc6962-bis  |    Version:
 Severity:  -            |   Keywords:
-------------------------+-------------------------------------------------

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/147>
trans <https://tools.ietf.org/trans/>