[pkix] [Errata Verified] RFC6960 (6166)

The following errata report has been verified for RFC6960,
"X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6166

--------------------------------------
Status: Verified
Type: Technical

Reported by: Yury Strozhevsky <[email protected]>
Date Reported: 2020-05-11
Verified by: Deb Cooley (IESG)

Section: Appendix B.2

Original Text
-------------
KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
                         -- (excluding the tag and length fields)


Corrected Text
--------------
KeyHash ::= OCTET STRING -- SHA-1 hash of responder's public key
                         -- (i.e., the SHA-1 hash of the value of the
                         -- BIT STRING subjectPublicKey [excluding
                         -- the tag, length, and number of unused
                         -- bits] in the responder's certificate)


Notes
-----
These two descriptions of KeyHash produce different SHA-1 hashes due to different values: one is pure BIT STRING value block, with "unused bits" byte, but other - without "unused byte". Also the Appendix B.2 must be aligned with Appendix B.1 information.

--------------------------------------
RFC6960 (draft-ietf-pkix-rfc2560bis-20)
--------------------------------------
Title               : X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Publication Date    : June 2013
Author(s)           : S. Santesson, M. Myers, R. Ankney, A. Malpani, S. Galperin, C. Adams
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
pkix mailing list -- [email protected]
To unsubscribe send an email to [email protected]