Subject: [Spasm] draft-housley-spasm-eku-constraints-03.txt

From: Russ Housley <[email-masked]>
Date: Thu, 26 May 2016 16:52:41 -0400

This just fixes the ASN.1 mistake in the version that was posted yesterday.

Russ

> From: [email-masked]
> Subject: New Version Notification for draft-housley-spasm-eku-constraints-03.txt
> Date: May 26, 2016 at 4:51:32 PM EDT
> To: "Russ Housley" <[email-masked]>, "Russell Housley" <[email-masked]>
> 
> 
> A new version of I-D, draft-housley-spasm-eku-constraints-03.txt
> has been successfully submitted by Russell Housley and posted to the
> IETF repository.
> 
> Name:		draft-housley-spasm-eku-constraints
> Revision:	03
> Title:		Extended Key Usage Constraints
> Document date:	2016-05-26
> Group:		Individual Submission
> Pages:		9
> URL:            https://www.ietf.org/internet-drafts/draft-housley-spasm-eku-constraints-03.txt
> Status:         https://datatracker.ietf.org/doc/draft-housley-spasm-eku-constraints/
> Htmlized:       https://tools.ietf.org/html/draft-housley-spasm-eku-constraints-03
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-housley-spasm-eku-constraints-03
> 
> Abstract:
>   This document specifies the extended key usage constraints
>   certificate extension, which is used to place restrictions on the key
>   purpose identifiers that are authorized to appear in the end-entity
>   certificate in a certification path.  Restrictions apply to the
>   extended key usage certificate extension, which is described in
>   RFC 5280.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 26 May 2016 18:01:30 -0400

Hi Russ,

Section 2 states "  Conforming applications MUST be able to process this
extension.  If
   any CA certificate in the certification path includes an extended key
   usage constraints extension and the end-entity certificate includes
   an extended key usage certificate extension, then the application
   MUST either process the extended key usage extension constraint or
   reject the certificate."

Since the path validation logic checks constraints even if EKU is absent in
the end-entity certificate, the above text should be revised to state:

"  Conforming applications MUST be able to process this extension.  If
   any CA certificate in the certification path includes an extended key
   usage constraints extension, then the application
   MUST either process the extended key usage extension constraint or
   reject the certificate."

Another option is to delete this text altogether since an application must
process an extension if it understands it regardless of criticality and must
reject the certificate if it does not understand a critical extension.

-----Original Message-----
From: Spasm [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Thursday, May 26, 2016 4:53 PM
To: [email-masked]
Subject: [Spasm] draft-housley-spasm-eku-constraints-03.txt

Russ

> Subject: New Version Notification for 
> draft-housley-spasm-eku-constraints-03.txt
> URL:
https://www.ietf.org/internet-drafts/draft-housley-spasm-eku-constraints-03.
txt
> Status:
https://datatracker.ietf.org/doc/draft-housley-spasm-eku-constraints/
> Htmlized:
https://tools.ietf.org/html/draft-housley-spasm-eku-constraints-03
> Diff:
https://www.ietf.org/rfcdiff?url2=draft-housley-spasm-eku-constraints-03
>   extended key usage certificate extension, which is described in

_______________________________________________
Spasm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/spasm

---

From: Russ Housley <[email-masked]>
Date: Thu, 26 May 2016 18:12:07 -0400

You are correct.  I’ll make the change in the next version.

Russ