Subject: RE: son-of-rfc3280 (grandson-of-rfc2459)

From: Sharon Boeyen <[email-masked]>
Date: Wed, 11 Jun 2003 12:11:26 -0400

Russ there are probably some additional X.509 defect reports that have 
been approved and reflected in formal Technical Corrigenda that should 
be at least considered to see if any of them also impact this update. 

-----Original Message-----
From: Russ Housley [mailto:[email-masked]]
Sent: Wednesday, June 11, 2003 9:55 AM
To: [email-masked]
Cc: [email-masked]
Subject: son-of-rfc3280 (grandson-of-rfc2459)

Dear PKIX WG:

I believe that an update to RFC 3280 is needed.  There are three major 
reasons that I believe an update is necessary:

1.  ITU-T is looking at changes to X.509 key usage extension.  The text in 
RFC 3280 section 4.2.1.3 has lead to a debate, which is not completely 
resolved.  Hoyt Kesterson has agreed to let the PKIX WG comment on the 
proposed text prior to publication.  So, once everyone is equally unhappy 
with the text, then both the ITU-T and the IETF should update their 
respective documents.

2.  Issues with UTF8 needs to be handled more clearly.  I believe that this 
should not be done until all of the issues associated with the use of UTF8 
in DNS are resolved.  I believe that certificates must use many of the same 
string comparison mechanisms as the DNS, and two solutions are unacceptable.

3.  Correct the error in section 6.3.3.  (see 
http://www.rfc-editor.org/errata.html).

Speaking as a co-author of RFC 3280, not as the Security Area Director,
    Russ