Subject: [pkix] CAA ABNF

From: "Manger, James H" <[email-masked]>
Date: Mon, 3 Dec 2012 11:13:28 +1100

One more technical typo in draft-ietf-pkix-caa: the ABNF in section 5.2 "CAA issue Property" for parameters is not quite right. <value> is <*VCHAR>, which allows ";", which is ambiguous with ";" as a separator of <parameter>s.

For instance, does the following CAA RR value have 1 parameter (with value "34;bar=1") or 2 parameters?

  CAA 0 issue "ca.example.net; foo=34;bar=1"

Given that everything after the first ";" is non-standard, the CAA spec could define the "issue" property's value as:

  issue-val = space [domain] space [";" extra]

  extra = *VCHAR

Alternative, change <value> from <*VCHAR> to <%x21-3A / %x3C-7E>.

Does any extra part after the domain need to be understood if the critical flag is set? For instance, is red-ca.example allowed to issue a cert if it doesn't understand the "foo" parameter given these CAA records? I think understanding "issue" is sufficient so red-ca may issue the cert. Can ca.example.net issue a cert if it doesn't understand "foo"? Might be worth explicitly mentioning in the spec.

  CAA 128 issue "ca.example.net; foo=34"
  CAA   0 issue "red-ca.example"

--
James Manger