Subject: Re: [pkix] [Technical Errata Reported] RFC5755 (3731)

From: Tom Gindin <[email-masked]>
Date: Tue, 8 Oct 2013 09:12:46 -0400

The note is too conclusory, since DigestedData and 
AuthenticatedData also use encapsulatedContentInfo.  However, the 
correction seems right.

Tom Gindin

From:   RFC Errata System <[email-masked]>
To:     [email-masked], [email-masked], [email-masked], 
[email-masked], [email-masked], [email-masked], 
[email-masked], 
Cc:     [email-masked], [email-masked], [email-masked]
Date:   09/30/2013 02:35 PM
Subject:        [pkix] [Technical Errata Reported] RFC5755 (3731)
Sent by:        [email-masked]

The following errata report has been submitted for RFC5755,
"An Internet Attribute Certificate Profile for Authorization".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=5755&eid=3731

--------------------------------------
Type: Technical
Reported by: Leonardo Cotta de Almeida <[email-masked]>

Section: 7.1

Original Text
-------------
   Within EnvelopedData, the encapsulatedContentInfo identifies the
   content type carried within the ciphertext.  In this case, the
   contentType field of encapsulatedContentInfo MUST contain id-ct-
   attrCertEncAttrs, which has the following value:

Corrected Text
--------------
   Within EnvelopedData, the encryptedContentInfo identifies the
   content type carried within the ciphertext.  In this case, the
   contentType field of encryptedContentInfo MUST contain id-ct-
   attrCertEncAttrs, which has the following value:

Notes
-----
The EnvelopedData structure has no "EncapsulatedContentInfo". It has a 
"EncryptedContentInfo":

      EnvelopedData ::= SEQUENCE {
        version CMSVersion,
        originatorInfo [0] IMPLICIT OriginatorInfo OPTIONAL,
        recipientInfos RecipientInfos,
        encryptedContentInfo EncryptedContentInfo,
        unprotectedAttrs [1] IMPLICIT UnprotectedAttributes OPTIONAL }

CMS objects that carry a "EncapsulatedContentInfo" are of type 
"SignedData":

      SignedData ::= SEQUENCE {
        version CMSVersion,
        digestAlgorithms DigestAlgorithmIdentifiers,
        encapContentInfo EncapsulatedContentInfo,
        certificates [0] IMPLICIT CertificateSet OPTIONAL,
        crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
        signerInfos SignerInfos }

Source: RFC 5652 (unchanged at least since RFC 3852).

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5755 (draft-ietf-pkix-3281update-05)
--------------------------------------
Title               : An Internet Attribute Certificate Profile for 
Authorization
Publication Date    : January 2010
Author(s)           : S. Farrell, R. Housley, S. Turner
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix