Subject: [TLS] Questions on certificate_extensions...

From: Dr Stephen Henson <[email-masked]>
Date: Tue, 14 Feb 2017 20:28:28 +0000

A couple of questions on the format and handling of certificate_extensions.

What format is the data that appears in certificate_extension_values? I'd say
that it should be in the same format as the content octets of the extnValue
field of Extension (from RFC5280 et al). So (for example) it would be a BIT
STRING for Key Usage and a SEQUENCE OF OBJECT IDENTIFIER for Extended Key Usage.

As regards the matching rules. How do these apply when a particular extension is
absent from the certificate? For example an absent Key Usage is often taken to
mean no Key Usage restrictions apply. If Key Usage is present in
certificate_extensions does it *require* that the Key Usage extension is
explicitly present in the certificate?

Steve.
-- 
Dr Stephen N. Henson.
Core developer of the   OpenSSL project: http://www.openssl.org/
Freelance consultant see: http://www.drh-consultancy.co.uk/
Email: [email-masked], PGP key: via homepage.

---

From: Andrei Popov <[email-masked]>
Date: Wed, 15 Feb 2017 01:07:55 +0000

> So (for example) it would be a BIT STRING for Key Usage and a SEQUENCE OF OBJECT IDENTIFIER for Extended Key Usage.
This is correct. The idea is to use the same format your PKI library already knows how to deal with.

> As regards the matching rules. How do these apply when a particular extension is absent from the certificate?
"If the server has included a
  non-empty certificate_extensions list, the client certificate MUST
  contain all of the specified extension OIDs that the client
  recognizes."

> For example an absent Key Usage is often taken to mean no Key Usage restrictions apply. If Key Usage is present in certificate_extensions does it *require* that the Key Usage extension is explicitly present in the certificate?
Based on the above, yes. However, a client that does not recognize e.g. Key Usage extension, must ignore and skip to the next CertificateExtension.

Cheers,

Andrei

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Dr Stephen Henson
Sent: Tuesday, February 14, 2017 12:28 PM
To: [email-masked] list <[email-masked]>
Subject: [TLS] Questions on certificate_extensions...

What format is the data that appears in certificate_extension_values? I'd say that it should be in the same format as the content octets of the extnValue field of Extension (from RFC5280 et al). So (for example) it would be a BIT STRING for Key Usage and a SEQUENCE OF OBJECT IDENTIFIER for Extended Key Usage.

As regards the matching rules. How do these apply when a particular extension is absent from the certificate? For example an absent Key Usage is often taken to mean no Key Usage restrictions apply. If Key Usage is present in certificate_extensions does it *require* that the Key Usage extension is explicitly present in the certificate?

Steve.

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls