Subject: Progress report: RFC 3280/3281 Interop testing

From: Tim Polk <[email-masked]>
Date: Wed, 22 Jan 2003 13:38:15 -0500

Folks,

This message is both a progress report on the RFC 3280 and 3281 testing and 
a request for your assistance in completing that testing.

We are working from a matrix initially developed by Jim Schaad.  Chris 
Brown here at NIST is performing the certificate and CRL feature testing, 
with assistance from Nelson Hastings and David Cooper.  We are also working 
with DigitalNet (formerly Getronics) and DoD to develop tests for the path 
validation algorithm.  David Cooper is the NIST lead for that project.

The certificate and CRL feature testing is largely complete.  We have 
generated two examples for most features from at least two independent 
implementations.  However, we need to obtain examples for a few remaining 
features.

The list is appended at the end of this message.  The list is divided into 
nine certificate fields and 10 CRL "fields", with a number of 
subcategories.  We are looking for folks that have an implementation which 
satisfies these requirements, and can generate some examples for 
us.  Examples don't need to implement all of the subcategories; examples 
that satisfy any one of them are acceptable!

If you can help, please send email to Chris Brown.  I cc'ed him on this 
message so that you will all have his email address.  Chris will need to 
obtain at a minimum the certificate or CRL, but a path associated with the 
certificate would be even more helpful.  Please specify 
which   implementation was used to generate the example(s).

When the path validation tests are complete, we will be looking for 
volunteers to execute those tests as well.  I will update the list on that 
part of the testing once we are ready to go.

Thanks,

Tim Polk

------------------------------- remaining features for RFC 3280 and 3281 
----------------------

CERTIFICATE FIELD #1: Names (subject or issuer acceptable)
	Need one example each for names including the following attributes
a)	dNqualifier
b)	givenName
c)	initials
d)	pseudonym
e)	generationQualifier
f)	domainComponents

CERTIFICATE FIELD #2: subject
*	empty subject DN with critical altSubjectName (need 1 example – have MISPC)

CERTIFICATE FIELD #3: SubjectPublicKey
a)	DSA public key with parameters omitted
b)	elliptic key with parameters present
c)	elliptic curve key with NULL parameters (need 1 example: have Entrust)
d)	Diffie-Hellman

CERTIFICATE FIELD #4: Signature field
*	ECDSA signature (need 1 example: have Entrust)

CERTIFICATE FIELD #5: Certificate policy extension
*	CPS pointer qualifier (need 1 example: have openSSL)

CERTIFICATE FIELD #6: SubjectAltName
a)	IPv6 addresses (have one example from David; Chris will complete using 
OpenSSL)
b)	OtherName
c)	resolution – Chris will generate with openSSL given DER encoding which 
David will provide; David will generate examples with MISPC

CERTFICATE FIELD #7: CRL distribution points
a)	CA != issuer [indirect CRLs]
b)	CRLissuer field that has multiple names, and distribution point has a 
non-relative name

CERTIFICATE FIELD #8: authority information access extension
*	id-ca-issuers where location is a DN

CERTIFICATE FIELD #9: subject information access
a)	id-ca-repository and
	1.	location is URI
	2.	location is DAP
	3.	location is rfc822

CRL FIELD #1: SignatureAlgorithm
*	ECDSA with parameters NULL (1 example – have Entrust)

CRL FIELD #2: Issuer Name
a)	Distinguished name qualifier, state or province name, common name, 
serial number (1 example – have OpenSSL)
b)	Locality, title, surname(2 examples), given name, initials, pseudonym, 
generation qualifier (1 example – have OpenSSL)
c)	Use BMPString (2 examples)
d)	Use UTF8String (2 examples)

CRL FIELD #3: This Update
*	Date >= 2050, encoded as GeneralizedTime (2 examples)

CRL FIELD #4: Next Update
*	Date >= 2050, encoded as GeneralizedTime (2 examples)

CRL FIELD #5: Issuer Alternative Name
a)	IpV4 address (iPlanet encoded w/ 8 octet bytes ???? ) DNS Name ( 1 
example – have iPlanet)
b)	IpV6 address,  other name (2 examples)

CRL #6: CRL Number
a)	Delta and CRLs on the same scope must share one numbering sequence (1 
example – have iPlanet)
b)	Delta and CRL on same scope issued at same time must have same number (2 
examples)

CRL #7: Delta Indicator
*	(need 2 examples)
a)	MUST list as removeFromHold in delta if held since base but now not held
b)	MUST list as removeFromCRL if certificate has expired and was revoked
c)	MUST include revoked and expired certificate on delta until it appears 
on at least one full CRL
*	(1 example – have iPlanet)
d)	All referenced base CRLs must be full CRLs
e)	Delta CRLs MUST contain this extension as crititcal
f)	Base and Delta MUST omit CDP or have identical CDPs
g)	Use same key for Base and Delta CRLs
h)	MUST include cert on delta if status changed since base

CRL #8: Issuing Distribution Point
a)	If onlySomeReasons omitted, CRL MUST have all reasons (1 example – have 
Entrust)
b)	CRL issuer MUST assert indirectCRL for non_CA issued CRLs (1 example – 
have iPlanet)

CRL #9: Freshest CRL
*	All tests (2 examples)
a)	Extension must be non-critical
b)	Extension must not be present in delta CRLs
c)	Omit reasons and CRLIssuer from extension

CRL #10: CRL Entry Extensions
a)	Hold Instruction Code (1 example – have OpenSSL)
b)	Certificate Issuer (2 examples)

---

From: Christopher Brown <[email-masked]>
Date: Fri, 24 Jan 2003 15:13:13 -0500

>*       empty subject DN with critical altSubjectName (need 1 example  
>have MISPC)
>**** COMPLETE ****

>CERTIFICATE FIELD #6: subjectAltName
>b)      OtherName
>**** COMPLETE ****

Thanks Steve Henson and David Cross