Subject: RFC 2560 question

From: Sven Heiberg <[email-masked]>
Date: Thu, 24 Jan 2002 15:44:53 +0200 (EET)

Hello

I have a simple question about RFC 2560. I suspect that there is a typo in 
the RFC. I looked through the archives and encounterd two letters that had 
the same question I'm having. Unfortunately the question was not answered, 
at least I could not find the answer from the archives.

Question:

In RFC 2560 section 4.2.2.2 (Authorized responders) it is told:

"OCSP signing delegation SHALL be designated by the inclusion of 
id-kp-OCSPSigning in an extendedKeyUsage certificate extension included in 
the OCSP response signer's certificate."

Few lines ahead one can read:

"Systems or applications that rely on OCSP responses MUST be capable of 
detecting and enforcing use of the id-ad-ocspSigning value as described 
above."

This happens to be the first place in the RFC where the id-ad-ocspSigning 
object identifier gets mentioned. From the context I get the feeling that 
one has meant id-kp-OCSPSigning instead.

Is this typo? Should one read id-kp-OCSPSigning instead id-ad-ocspSigning?

	Sven Heiberg

---

From: Ambarish Malpani <[email-masked]>
Date: Thu, 24 Jan 2002 10:09:38 -0800

Hi Sven,
    You are right - that is a typo.

I hadn't seen that comment before, therefore it wasn't addressed
earlier.

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Sven Heiberg [mailto:[email-masked]]
> Sent: Thursday, January 24, 2002 5:45 AM
> To: [email-masked]
> Subject: RFC 2560 question
> 
> 
> 
> 
> Hello
>