Subject: Re: [IPsec] #120: CA indication with cert req - allowed types

From: Tero Kivinen <[email-masked]>
Date: Mon, 2 Nov 2009 16:18:59 +0200

David Wierbowski writes:
> > So the text most likely should say that "For other values the
> > certificate authority field contents is not defined, and can be
> > anything (or empty) until specifications that specify their contents
> > is published."
> I do not think they can be anything.  I think they need to be empty until
> specifications that specify their contents are published.

Thats fine for the sending side, but for recipient it is very hard to
know when specification has been published, thus recipient should not
reject (or crash) in case it receives certreq having type of x and
having something inside the certificate authority field, even though
no specification was available when that implementation was created.

Thats why I think it would be safer to say they can be anything, or
perhaps more accurate should say they MUST be sent as empty, but
recipient MUST be able to handle CERTREQ regardless what there is in
the certificate authority field.

But on the other hand I do not think we want to add new MUSTs/SHOULDs
etc here, but just say they can be anything (including empty) should
be enough.
-- 
[email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 24 Nov 2009 19:08:42 +0200

Please also see Tero's follow-up here: http://www.ietf.org/mail-archive/web/ipsec/current/msg04990.html

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Yaron Sheffer
Sent: Friday, October 30, 2009 1:15
To: IPsecme WG
Subject: [IPsec] #120: CA indication with cert req - allowed types

Sec. 3.7 has:

The contents of the "Certification Authority" field are defined only for X.509 certificates, which are types 4, 10, 12, and 13. Other values SHOULD NOT be used until standards-track specifications that specify their use are published.

This excludes certificate requests of type 7, i.e. for CRLs. For requesting a specific CRL type 7 would make sense, in particular in chain situations. Should we add it to the list of allowed types here?

OTOH, this allows type 10, which is unspecified and should be removed.

Scanned by Check Point Total Security Gateway.

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 25 Nov 2009 14:30:14 +0200

Yaron Sheffer writes:
> Please also see Tero's follow-up here:
> http://www.ietf.org/mail-archive/web/ipsec/current/msg04990.html 

I still agree what I said back then :-)

> The contents of the "Certification Authority" field are defined only
> for X.509 certificates, which are types 4, 10, 12, and 13. Other
> values SHOULD NOT be used until standards-track specifications that
> specify their use are published. 
> 
> This excludes certificate requests of type 7, i.e. for CRLs. For
> requesting a specific CRL type 7 would make sense, in particular in
> chain situations. Should we add it to the list of allowed types
> here? 
> 

And there is also format 14 which also can be sent as CERTREQ and it
can have empty certificate authority or it can have some hashes from
trusted responder's public keys.
-- 
[email-masked]