Subject: support for multiple authorityKeyID OIDs

From: [email-masked]
Date: Tue, 17 Sep 2002 10:44:16 -0400

I have found references that identify 2 OIDs that have been assigned to 
authorityKeyID and was wondering if applications still need to support 
both.   The reference, http://www.alvestrand.no/objectid/2.5.29.html, 
indicated the first (2.5.29.2) might be obsolete.  I have been unable to 
determine how to access an official listing for this branch but did see 
Peter Gutmann's dumpasn1.config confirm the deprecation. Can anyone point 
me in the right direction for the officially maintained list?  I saw that 
Russ Housley maintains the PKIX OIDs but this value seems to be under 
others control.

Do any CAs still issue using 2.5.29.1 or is everyone currently using 
2.5.29.35? 

Do any certs still exist as valid that had 2.5.29.1 values set?

Thanks,
Chris Ryan
Security and Technology Services
Ernst & Young

________________________________________________________________________
The information contained in this message may be privileged and confidential and protected from disclosure.  If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer.  Thank you.  Ernst & Young LLP

---

From: Phil Griffin <[email-masked]>
Date: Tue, 17 Sep 2002 13:19:30 -0400

The X.509 certificate extension OID arc, 2.5.29 can be
referenced in several formats on the ASN.1 Information
site, http://asn1.elibel.tm.fr/en/oid/index.htm.

The X.500 series module database maintained by the
ITU-T, http://www.itu.int/ITU-T/asn1/database/itu-t/x/,
has detailed information taken from the Directory
standards.

See especially the bottom of the X.509 module at

http://www.itu.int/ITU-T/asn1/database/itu-t/x/
    x509/1997/CertificateExtensions.asn

and notice that { id-ce 2 } is no longer used:

--  The following OBJECT IDENTIFIERS are not used by this
--  Specification:
--  {id-ce 2}, {id-ce 3}, {id-ce 4}, {id-ce 5}, {id-ce 6},
--  {id-ce 7}, {id-ce 8}, {id-ce 10}, {id-ce 11}, {id-ce 12},
--  {id-ce 13}, {id-ce 22}, {id-ce 25}, {id-ce 26}

Phil

[email-masked] wrote:

>  indicated the first (2.5.29.2) might be obsolete.  I have been unable 
> to determine how to access an official listing for this branch but did 
> see Peter Gutmann's dumpasn1.config confirm the deprecation. Can anyone 
> point me in the right direction for the officially maintained list?  I 
> saw that Russ Housley maintains the PKIX OIDs but this value seems to be 
> under others control.
> 
> The information contained in this message may be privileged and 
> confidential and protected from disclosure. If the reader of this 
> message is not the intended recipient, or an employee or agent 
> responsible for delivering this message to the intended recipient, you 
> are hereby notified that any dissemination, distribution or copying of 
> this communication is strictly prohibited. If you have received this 
> communication in error, please notify us immediately by replying to the 
> message and deleting it from your computer. Thank you. Ernst & Young LLP