Re: [Technical Errata Reported] RFC5280 (5802)

Hi Martin,

On Tue, Aug 06, 2019 at 11:21:46PM +0200, Martin Rex wrote:
> Russ Housley <[email protected]> wrote:
> > At the time that these values were assigned, TLS was primarily a
> > protocol for WWW security.  It has since been used in may other
> > environments.  I do not see how a change to the comment in the
> > ASN.1 definition will make any real difference, but I do not really
> > have an objection.
> > 
> > I suggest that this be marked as "Hold for Document Update"
> 
> 
> The applicable **STANDARDS** in this area would be
> rfc5246 (TLSv1.2) and rfc2818 (HTTP over TLS), and both are
> **SILENT** on EKU.
> 
> What openssl does is a non-standard, implementation-defined behaviour,
> and I consider it a particularly bad idea trying to rewrite history
> by filing this as an errata !
> 
> 
> I've also seen a public CA (Entrust) issue a TLS server certificate
> which asserted id-kp-serverAuth, but was lacking id-kp-clientAuth.
> I consider such a certificate a stupid clerical error by Entrust.
> 
> Whether TLS client software is willing to use such a certificate
> as TLS client certificate, and whether TLS server software is willing
> to accept such a TLS server certificate as TLS client certificate
> turns out to be *VERY* implementation-specific.
> 
> 
> If changing the limited-applicability comment in rfc5280 for
> id-kp-serverAuth and id-kp-clientAuth at all, then it should also
> include which **application**standards**, if any, gives any meaning
> to these EKUs, and where application standards have *NOT* been
> giving any meaning all the time, the behaviour is implementation-defined
> at best.

We're not changing anything, here; we're just making a note that the
unfortunate people stuck doing a bis of this document should look at this
one issue.  If you think they should also look at an other (related) issue
at the same time, you are free to submit a separate errata report, but I
don't see much reason to think that the two topics should be consolidated
into a single report.

I plan to mark this as HFDU as Russ suggests.

-Ben

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix