Subject: Re: 3280bis: extension criticality treatment

From: Peter Sylvester <[email-masked]>
Date: Wed, 17 Nov 2004 15:31:29 +0100 (MET)

> 
> I can recall threads where it was stated that recognized extensions MUST 
> be processed irrespective of the their criticality. Should we clarify 
> this in RFC3280bis?

I suggest to add explicitely: 

  If extensions are treated, thus MUST be done independantly from
  the value of criticality bit. 

unless this text already appears somewhere, or can be concluded
by simply binary logic from other MUST's MAY etc.

---

From: Stephen Henson <[email-masked]>
Date: Wed, 17 Nov 2004 16:51:19 +0000

Peter Sylvester wrote:
>> I can recall threads where it was stated that recognized extensions
>> MUST be processed irrespective of the their criticality. Should we
>> clarify this in RFC3280bis?
> 
> 
> If extensions are treated, thus MUST be done independantly from the
> value of criticality bit.
> 
> unless this text already appears somewhere, or can be concluded by
> simply binary logic from other MUST's MAY etc.
> 

X509 leaves no doubt:

> When a certificate-using implementation recognizes and is able to
> process an extension, then the certificate-using implementation shall
> process the extension regardless of the value of the criticality
> flag.

I've lost count of the number of "bug reports" I've received prompted 
by rejection of a certificate path due to a processing of a
non-critical extension. They typically quote variations on the "its
non-critical so it can be ignored" argument.

This suggests, to me at least, that even if this can be inferred from 
the other text, it isn't clear enough and should be explicitly stated.

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.