Subject: [pkix] [Errata Rejected] RFC6844 (4515)

From: RFC Errata System <[email-masked]>
Date: Tue, 22 Aug 2017 10:34:31 -0700 (PDT)

The following errata report has been rejected for RFC6844,
"DNS Certification Authority Authorization (CAA) Resource Record".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid4515

--------------------------------------
Status: Rejected
Type: Technical

Reported by: Tom Clegg <[email-masked]>
Date Reported: 2015-10-29
Rejected by: Kathleen Moriarty (IESG)

Section: 4

Original Text
-------------
   o  If A(X) is not null, and R(A(X)) is not empty, then R(X) =
      R(A(X)), otherwise

Corrected Text
--------------
   o  If A(X) is not null, and CAA(A(X)) is not empty, then R(X) =
      CAA(A(X)), otherwise

Notes
-----
R is the algorithm being described here, so R(A(X)) means a recursive search on the CNAME target, including its parents. However, the example that follows, Parent(Alias(x.y.z)) is not part of the search. Either the algorithm is incorrectly specified, or the example is incomplete.

While this change is correct, it has already been accepted with HFDU in errata 5065.
 --VERIFIER NOTES-- 
   Errata 5065 was accepted first and covers this error.

--------------------------------------
RFC6844 (draft-ietf-pkix-caa-15)
--------------------------------------
Title               : DNS Certification Authority Authorization (CAA) Resource Record
Publication Date    : January 2013
Author(s)           : P. Hallam-Baker, R. Stradling
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG