Subject: [pkix] [Technical Errata Reported] RFC2560 (3272)

From: RFC Errata System <[email-masked]>
Date: Fri, 29 Jun 2012 10:21:49 -0700 (PDT)

The following errata report has been submitted for RFC2560,
"X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=2560&eid=3272

--------------------------------------
Type: Technical
Reported by: Matthew Moore <[email-masked]>

Section: 4.1.1

Original Text
-------------
   OCSPRequest     ::=     SEQUENCE {
       tbsRequest                  TBSRequest,
       optionalSignature   [0]     EXPLICIT Signature OPTIONAL }

   TBSRequest      ::=     SEQUENCE {
       version             [0]     EXPLICIT Version DEFAULT v1,
       requestorName       [1]     EXPLICIT GeneralName OPTIONAL,
       requestList                 SEQUENCE OF Request,
       requestExtensions   [2]     EXPLICIT Extensions OPTIONAL }

   Signature       ::=     SEQUENCE {
       signatureAlgorithm      AlgorithmIdentifier,
       signature               BIT STRING,
       certs               [0] EXPLICIT SEQUENCE OF Certificate 
   OPTIONAL}

   Version         ::=             INTEGER  {  v1(0) }

   Request         ::=     SEQUENCE {
       reqCert                     CertID,
       singleRequestExtensions     [0] EXPLICIT Extensions OPTIONAL }

   CertID          ::=     SEQUENCE {
       hashAlgorithm       AlgorithmIdentifier,
       issuerNameHash      OCTET STRING, -- Hash of Issuer's DN
       issuerKeyHash       OCTET STRING, -- Hash of Issuers public key
       serialNumber        CertificateSerialNumber }

Corrected Text
--------------
...
   Version         ::=             INTEGER  {  v1(0) }

   GeneralName     ::=      ????
...

Notes
-----
The format of the GeneralName in the request syntax is never detailed.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC2560 (draft-ietf-pkix-ocsp-07)
--------------------------------------
Title               : X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP
Publication Date    : June 1999
Author(s)           : M. Myers, R. Ankney, A. Malpani, S. Galperin, C. Adams
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Peter Sylvester <[email-masked]>
Date: Mon, 02 Jul 2012 18:27:56 +0200

The errata is invalid since the definitions are imported from other modules.

On the other hand, since ocsp might be updated, it seems useful to me
to add two sections at the beginning:

x: This documents defines one ASN.1 module:

OCSP-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-ocsp-02(48)}
   DEFINITIONS EXPLICIT TAGS ::=
   BEGIN

y: The module imports the following definitions from other modules:

   IMPORTS

   Extensions{}, EXTENSION, ATTRIBUTE
   FROM PKIX-CommonTypes-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)}

   AlgorithmIdentifier{}, DIGEST-ALGORITHM, SIGNATURE-ALGORITHM
   FROM AlgorithmInformation-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0)
       id-mod-algorithmInformation-02(58)}

   AuthorityInfoAccessSyntax, GeneralName, CrlEntryExtensions
   FROM PKIX1Implicit-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-implicit-02(59)}

   Name, CertificateSerialNumber, id-kp, id-ad-ocsp, Certificate
   FROM PKIX1Explicit-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0) id-mod-pkix1-explicit-02(51)}

   sa-dsaWithSHA1, sa-rsaWithMD2, sa-rsaWithMD5, sa-rsaWithSHA1
   FROM PKIXAlgs-2009
       {iso(1) identified-organization(3) dod(6) internet(1) security(5)
       mechanisms(5) pkix(7) id-mod(0)
       id-mod-pkix1-algorithms2008-02(56)};

etc.

On 06/29/2012 07:21 PM, RFC Errata System wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix