Subject: RE: I-D ACTION:draft-ietf-smime-3850bis-04.txt

From: "Jim Schaad" <[email-masked]>
Date: Mon, 28 Jul 2008 14:43:00 +0100

Comments on the draft.

In section 4.4.3, I find the following text confusing:

End-entity certificates contain an extension that 
   constrains the certificate from being an issuing authority 
   certificate (see Section 4.4.2). 

I believe that this text might be better as it clarifies what is being
stated.  I.e. it is not the fact that basic constraints is being used which
actually does the mentioned constraint.

End-entity certificates contain the Key Usage extension which restraints the
end-entity from using the key to perform issuing authority operations (see
4.4.4)

Also the previous comment (on 3851bis) on key sizes > 4096 should be applied
to this document

jim

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of [email-masked]
> Sent: Tuesday, July 01, 2008 1:30 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: I-D ACTION:draft-ietf-smime-3850bis-04.txt
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the S/MIME Mail Security Working Group of
> the IETF.
> 
> 	Title		: Secure/Multipurpose Internet Mail Extensions
> (S/MIME) Version 3.2 Certificate Handling
> 	Author(s)	: S. Turner, B. Ramsdell
> 	Filename	: draft-ietf-smime-3850bis-04.txt
> 	Pages		: 20
> 	Date		: 2008-6-30
> 
> This document specifies conventions for X.509 certificate usage by
>    Secure/Multipurpose Internet Mail Extensions (S/MIME) agents.
> S/MIME
>    provides a method to send and receive secure MIME messages, and
>    certificates are an integral part of S/MIME agent processing.
> S/MIME agents validate certificates as described in RFC 3280bis, the
>    Internet X.509 Public Key Infrastructure Certificate and CRL
> Profile.
>    S/MIME agents must meet the certificate processing requirements in
>    this document as well as those in RFC 3280bis. This document
>    obsoletes RFC 3850.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-smime-3850bis-04.txt
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.

---

From: "Jim Schaad" <[email-masked]>
Date: Mon, 28 Jul 2008 16:05:16 +0100

I got some section numbers wrong in typing.

The text in question is in section 4.4.1,
The reference in the new text should still be to section 4.4.2

Jim

> [email-masked]] On Behalf Of Jim Schaad
> Sent: Monday, July 28, 2008 2:43 PM
> To: Sean P. Turner; 'Blake Ramsdell'
> Cc: [email-masked]
> Subject: RE: I-D ACTION:draft-ietf-smime-3850bis-04.txt
> 
> 
> Comments on the draft.
>

---

From: "Turner, Sean P." <[email-masked]>
Date: Mon, 28 Jul 2008 21:18:29 +0100

Other things Jim requested offline:
 - Point to PKIXALG as opposed to CMSALG, which makes sense since this is
the CERT ID.
 - Add back in changes from v3 to v3.1, which also makes sense because the
section should not have been removed.

spt
>From: Jim Schaad [mailto:[email-masked]] 
>I believe that this text might be better as it clarifies what 
>is being stated.  I.e. it is not the fact that basic 
>constraints is being used which actually does the mentioned constraint.
>
>
>End-entity certificates contain the Key Usage extension which 
>restraints the end-entity from using the key to perform 
>issuing authority operations (see
>4.4.4)
>
>Also the previous comment (on 3851bis) on key sizes > 4096 
>should be applied to this document
>
>jim
>