Subject: Re: [pkix] Next edition of X.509

From: Erwann Abalea <[email-masked]>
Date: Mon, 21 Mar 2016 16:49:40 +0100

Bonjour,

One comment on edition 2012 of X.509.

I think that the new ASN.1 definition of TBSCertificate is wrong, in the
extension markers and comments.

TBSCertificate ::= SEQUENCE {
  version                  [0] Version DEFAULT v1,
  serialNumber                 CertificateSerialNumber,
  signature                    AlgorithmIdentifier{{SupportedAlgorithms}},
  issuer                       Name,
  validity                     Validity,
  subject                      Name,
  subjectPublicKeyInfo         SubjectPublicKeyInfo,
  issuerUniqueIdentifier   [1] IMPLICIT UniqueIdentifier OPTIONAL,
  ...,
  [[2: -- if present, version shall be v2 or v3
  subjectUniqueIdentifier  [2] IMPLICIT UniqueIdentifier OPTIONAL]],
  [[3: -- if present, version shall be v2 or v3
  extensions               [3]  Extensions OPTIONAL]]
  -- If present, version shall be v3]]
}

should be

TBSCertificate ::= SEQUENCE {
  version                  [0] Version DEFAULT v1,
  serialNumber                 CertificateSerialNumber,
  signature                    AlgorithmIdentifier{{SupportedAlgorithms}},
  issuer                       Name,
  validity                     Validity,
  subject                      Name,
  subjectPublicKeyInfo         SubjectPublicKeyInfo,
  ...,
  [[2: -- if present, version shall be v2 or v3
  issuerUniqueIdentifier   [1] IMPLICIT UniqueIdentifier OPTIONAL,
  subjectUniqueIdentifier  [2] IMPLICIT UniqueIdentifier OPTIONAL]],
  [[3: -- if present, version shall be v3
  extensions               [3]  Extensions OPTIONAL]]
}

You could also add some constraints:

(
    WITH COMPONENTS { version (v1), issuerUniqueIdentifier ABSENT,
subjectUniqueIdentifier ABSENT, extensions ABSENT }
  | WITH COMPONENTS { version (v2), issuerUniqueIdentifier OPTIONAL,
subjectUniqueIdentifier OPTIONAL, extensions ABSENT }
  | WITH COMPONENTS { version (v3), issuerUniqueIdentifier OPTIONAL,
subjectUniqueIdentifier OPTIONAL, extensions OPTIONAL }
)

2015-12-07 11:33 GMT+01:00 Erik Andersen <[email-masked]>:

> In preparation for the next edition of X.509 (the 2016 edition), I have
> forwarded to the ISO/IEC JTC1/SC6 two documents for three months ballots:
>
>
>
> These two documents may be found as:
>
>
>
> 1.       http://www.x500standard.com/uploads/extensions/x509-pdam-amd2.pdf,
> which is the 3rd PDAM text for an amendment to X.509.
>
> 2.       http://www.x500standard.com/uploads/dtc/X509-Ed7-Cor2.pdf, which
> a second draft technical corrigendum. This technical corrigendum is based
> on a set of defects reports, which include the justification for the
> changes. The Defect reports may be found on
> http://www.x500standard.com/index.php?n=Ig.DefectReports.
>
>
>
> An early corrigendum has been approved within ISO and ITU-T and may be
> found as: http://www.x500standard.com/uploads/dtc/X509-Ed7-Cor1.pdf.
>
>
>
> These three documents together with the seventh edition will provide the
> input to the next edition of X.509. The different X.recommendations,
> including X.509, may be found at http://www.itu.int/rec/T-REC-X/e. This
> edition of X.509 is freely available in the PDF version.
>
>
>
> Those involved in  ISO/IEC JTC1/SC6 can, of course, submit ballot
> comments on the two documents out for ballot. Others, which may have
> comments on the these document, may post them on the lists and after
> consolidation and consensus, they may be issued as ITU-T comments.
>
>
>
> It is important to check whether any of the suggested changes affects
> running codes. If that is a case, it is a mistake.
>
>
>
> The intension behind the changes has been:
>
> 1.       A better separation between public-key certificates and
> attribute certificates.
>
> 2.       Use of a consistent terminology.
>
> 3.       Use of a consistent editing style in accordance with the ITU-T
> editing guidelines..
>
> 4.       A new PKI component called trust broker assists a relying party
> validating a public-key certificate is included.
>
> 5.       IEC TC57 WG15 has identified a requirement for a feature first
> called whitelist but now the term is authorization and validation list is
> used. A proposal for such a feature is included in the amendment.
>
> The main goal has been to position X.509 for new challenges, such  smart
> grid security and security for Internet of Things with battery driven
> devices, very short messages (can we put a 257 octets signature on a few
> octets message?) , short reaction time requirements, many millions of
> entities, etc. This is all very different from Web-based  systems.
>
> Kind regards,
>
> Erik
>
>
>
>
>
>
>
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>
>

-- 
Erwann.