Subject: [pkix] Tr : Re: [Editorial Errata Reported] RFC2560 (3251)

From: [email-masked]
Date: Wed, 13 Jun 2012 10:08:45 +0200

If we want to fix the text from RFC 2560 we cannot do it with cosmetic 
changes, 
like the one proposed, because the current text is wrong. The proposed way 
to fix it is also wrong.

In the most general case, where the OCSP response includes certificate 
statuses from different CAs, 
it is not possible to say that a BasicOCSPResponse is globally valid (or 
invalid), since it depends on 
the content of every SingleResponse. On the contrary, it is possible to 
provide criteria to determine 
whether a SingleResponse is or is not valid.

The whole section would need to be revised. For more information, see the 
slides I presented at the Paris meeting:
http://www.ietf.org/proceedings/83/slides/slides-83-pkix-4.pdf

So the question is whether we provide multiple ERRATA on many portions of 
the document or whether we progress rfc2560bis, 
to correct all the many errors at one time.

BTW, I would like to hear the editors to know what they have been doing 
(or not doing) since the Paris meeting 
to progress this draft. One of the co-editors is one of our co-chairs.

Denis

De :    "Miller, Timothy J." <[email-masked]>
A :     RFC Errata System <[email-masked]>, 
"[email-masked]" <[email-masked]>, "[email-masked]" 
<[email-masked]>, "[email-masked]" <[email-masked]>, 
"[email-masked]" <[email-masked]>, "[email-masked]" 
<[email-masked]>, "[email-masked]" 
<[email-masked]>, "[email-masked]" <[email-masked]>, 
"[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Cc :    "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Date :  12/06/2012 19:21
Objet : Re: [pkix] [Editorial Errata Reported] RFC2560 (3251)
Envoyé par :    [email-masked]

I have passive voice.  I suggest instead:

"...The certificate required to validate the signature on the response
MUST meet at least one of the following criteria:
1. ...
2. ...
3. ...
"""

-- T

On 6/11/12 8:33 PM, "RFC Errata System" <[email-masked]> wrote:

>
>The following errata report has been submitted for RFC2560,
>"X.509 Internet Public Key Infrastructure Online Certificate Status
>Protocol - OCSP".
>
>--------------------------------------
>You may review the report below and at:
>http://www.rfc-editor.org/errata_search.php?rfc=2560&eid=3251
>
>--------------------------------------
>Type: Editorial
>Reported by: Daniel Barclay <[email-masked]>
>
>Section: 4.2.2.2
>
>Original Text
>-------------
>...  They MUST reject the response if the certificate required to 
validate
>the signature on the response fails to meet at least one of the following
>criteria:
>
>   1. ...
>   2. ...
>   3. ...
>
>Corrected Text
>--------------
>...  They MUST reject the response if it is not the case that the
>certificate required to validate the signature on the response meets at
>least one of the following criteria:
>
>   1. ...
>   2. ...
>   3. ...
>
>Notes
>-----
>The "fails to meet at least one ... " part of the original wording is
>ambiguous. 
>
>It can sound like the grouping is "(fails to meet) at least one ..."
>rather than the (apparently) intended "fails to (meet at least one)".
>
>Note:  The submitted corrected text needs further improvement.  I think
>it eliminates the ambiguity, but it currently is harder to follow.
>
>Instructions:
>-------------
>This errata is currently posted as "Reported". If necessary, please
>use "Reply All" to discuss whether it should be verified or
>rejected. When a decision is reached, the verifying party (IESG)
>can log in to change the status and edit the report, if necessary.
>
>--------------------------------------
>RFC2560 (draft-ietf-pkix-ocsp-07)
>--------------------------------------
>Title               : X.509 Internet Public Key Infrastructure Online
>Certificate Status Protocol - OCSP
>Publication Date    : June 1999
>Author(s)           : M. Myers, R. Ankney, A. Malpani, S. Galperin, C.
>Adams
>Category            : PROPOSED STANDARD
>Source              : Public-Key Infrastructure (X.509)
>Area                : Security
>Stream              : IETF
>Verifying Party     : IESG
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix