Subject: RE: I-D ACTION:draft-ietf-pkix-rfc3280bis-01.txt

From: "Stefan Santesson" <[email-masked]>
Date: Fri, 22 Jul 2005 05:36:28 +0100

David,

The following sentence in the new first section of key usage, following
the bit definitions, seems to have typos in its construction:

                                                     " However, if the
   digitalSignature and/or nonRepudiation bits MAY bit set in addition
   to the keyCertSign and/or cRLSign bits if the subject public key is
   to be used to verify signatures on certificates and/or CRLs as well
   as other objects."

I guess the intended wording is:

                                                        " However, the
   digitalSignature and/or nonRepudiation bits MAY be set in addition
   to the keyCertSign and/or cRLSign bits if the subject public key is
   to be used to verify signatures on certificates and/or CRLs as well
   as other objects."

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of David A. Cooper
> Sent: den 20 juli 2005 14:31
> To: pkix
> Subject: Re: I-D ACTION:draft-ietf-pkix-rfc3280bis-01.txt
> 
> 
> [email-masked] wrote:
> 
> >A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> >This draft is a work item of the Public-Key Infrastructure (X.509)
> Working Group of the IETF.
> >
> >	Title		: Internet X.509 Public Key
> Infrastructure
> >                          Certificate and Certificate Revocation List
> (CRL) Profile
> >	Author(s)	: D. Cooper, et al.
> >	Filename	: draft-ietf-pkix-rfc3280bis-01.txt
> >	Pages		: 138
> >	Date		: 2005-7-20
> >
> >A URL for this Internet-Draft is:
> >http://www.ietf.org/internet-drafts/draft-ietf-pkix-rfc3280bis-01.txt
> >
> >
> 
> I have posted two "diff" files on the NIST Web site: one showing the
> differences between 3280bis-00 and 3280bis-01 and one showing the
> differences between RFC 3280 and 3280bis-01.  They are available at:
> 
> 
> http://csrc.nist.gov/pki/documents/PKIX/draft3280bis-00todraft3280bis-
> 01_diff.html
> 
> and
> 
> 
>
http://csrc.nist.gov/pki/documents/PKIX/rfc3280todraft3280bis-01_diff.ht
ml
> 
> 
> While I would encourage people to review the "diff" files to see what
> changes have been made, here is a list summarizing some of the changes
> that were made between draft -00 and draft -01:
> 
> 1) The descriptions of some of the keyUsage bits have been changed
based
> on discussions on the PKIX mail list.
> 
> 2) Section 4.2.1.9 has been modified to clarify that while conforming
CA
> certificates MUST include a basicConstraints extension, applications
MAY
> use certificates that do not include the basicConstraints extension as
> intermediate certificates if the certificates are version 1 or 2.
> 
> 3) The rules for specifying name constraints for URIs have been
changed
> back to the rules that were in RFC 3280.
> 
> 4) In order to align with draft-zeilenga-ldap-x509-01.txt, all example
> LDAP URIs (in the cRLDistributionPoints, authorityInfoAccess, and
> subjectInfoAccess extensions) specify the ";binary" option.
> 
> 5) Sections 5 and 5.2.5 have been modified to clarify the meaning of
an
> indirect CRL.
> 
> 6) Section 6.1 includes a new paragraph that explains that the path
> validation algorithm is not intended to verify that certificates and
> CRLs are issued in conformance with the PKIX profile.
> 
> 7) The sample certificates in appendix C have been changed.
> 
> 
> Dave

---

From: "David A. Cooper" <[email-masked]>
Date: Fri, 22 Jul 2005 08:54:01 -0400

Stefan,

Thanks for pointing this out.  Yes, the first "if" should be deleted.

I also discovered a typo in section 7.5, where I wrote "convertion" 
instead of "conversion".

Both of these will be fixed in the next draft.

Dave