From nobody Fri Feb 3 06:53:46 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07189129DAB for ; Fri, 3 Feb 2017 06:53:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.499 X-Spam-Level: X-Spam-Status: No, score=-7.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Aj33qXD0QtJV for ; Fri, 3 Feb 2017 06:53:42 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DCCD129DA7 for ; Fri, 3 Feb 2017 06:53:42 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id E76EEBE50; Fri, 3 Feb 2017 14:53:39 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9zN7ZmYCbsuc; Fri, 3 Feb 2017 14:53:39 +0000 (GMT) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 449C5BE4C; Fri, 3 Feb 2017 14:53:39 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1486133619; bh=IZ/q5oWbS11mt7M3f6UbHtvZ7w5a5X68Ia69X3PzzEw=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=v9UWsgO9EcLu1espuR3jYC7mIhEdLa5EqXUJk1ROhsEJ3LVFEgmVkKhNNSkJZxQtR d2pPAR0TEEoPCyyLnF3Pqri3E7r1lpPDmSmKHUr9SfV54OkLYSy9g0ovHahJxuxt71 W+xBsFHJVJHUrjYzLvzVELEvTEpp7+5CTO9GtKc8= To: RFC Errata System , philliph@comodo.com, rob.stradling@comodo.com, Kathleen.Moriarty.ietf@gmail.com, kent@bbn.com, stefan@aaa-sec.com References: <20170203141815.346CAB81685@rfc-editor.org> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Fri, 3 Feb 2017 14:53:39 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <20170203141815.346CAB81685@rfc-editor.org> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms020703010001000000040806" Archived-At: Cc: pkix@ietf.org, Attila.Bruncsak@itu.int Subject: Re: [pkix] [Technical Errata Reported] RFC6844 (4922) X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 14:53:45 -0000 This is a cryptographically signed message in MIME format. --------------ms020703010001000000040806 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, That strikes me, not as an erratum, but rather as a change request. IIRC, that specific issue was debated at the time so the text in the RFC is not an error, no matter whether or not one considers it a good or bad idea. On that basis I think this ought be rejected as an erratum, and if folks wish to fix this, they ought write an Internet-draft that updates RFC6844 and pursue publication of that through the normal processes. (I'd suggest the lamps WG [1] mailing list might be a good venue for any initial discussion as to the desirability of that kind of thing.) Cheers, S. [1] https://tools.ietf.org/wg/lamps/ On 03/02/17 14:18, RFC Errata System wrote: > The following errata report has been submitted for RFC6844, > "DNS Certification Authority Authorization (CAA) Resource Record". >=20 > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata_search.php?rfc=3D6844&eid=3D4922 >=20 > -------------------------------------- > Type: Technical > Reported by: Attila Bruncs=C3=83=C2=A1k >=20 > Section: 4 >=20 > Original Text > ------------- > The search for a CAA record climbs the DNS name tree from the > specified label up to but not including the DNS root '.'. >=20 > Corrected Text > -------------- > The search for a CAA record must not climb the DNS name tree from the > specified label up. >=20 > Notes > ----- > Obviously it does not make any sense to climb up. If there would be CAA= record published for the "com" TLD, than it would make what relation to = the CAA of the "example.com" domain? From an other viewpoint: all CAs are= going to check the "com" TLD for CAA record if a given organization has = no CAA record published in its own domain? > Another, more practical example: "example.com" needs a certificate for = his top domain (https://example.com/), so it decides to publish the CAA r= ecord to enforce the security. Doing this it may unknowingly affect the r= enewal of the certificate for the wellhidden.hr.example.com where the hr.= example.com domain is under different administrative authority than examp= le.com domain itself. >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC6844 (draft-ietf-pkix-caa-15) > -------------------------------------- > Title : DNS Certification Authority Authorization (CAA) R= esource Record > Publication Date : January 2013 > Author(s) : P. Hallam-Baker, R. Stradling > Category : PROPOSED STANDARD > Source : Public-Key Infrastructure (X.509) > Area : Security > Stream : IETF > Verifying Party : IESG >=20 --------------ms020703010001000000040806 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNzAyMDMx NDUzMzlaMC8GCSqGSIb3DQEJBDEiBCDABhreW35/GKdQTPQ5ijnFFuu4YjiiVn9zyLSQvB8H xzBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAlAr6Gv1EDBw8SX5gY4RgnytZC43okdEDZ4I/bM5FKAwyd7lPBwtGY Zb4bIHMVo/ndHpL8wdCpJ/mcVGNkkfBHbwi8vrKGOu16u3rTY8QQ6FfnABlWuEGlp8DYHXR/ JIFNy/I0nJr3wOFCcEYx/h8+q8uCwoefbZXSguZVkKzH8I1aNbvT2l4ui4X23RYzyp8kP6yZ jPfXEe3H5Foz5cmAq+32urX9Qe8IMaGW4n46cwq9XnC/YSVaV7DjpdwE7bBnvs9p4U1+orEg TrwpJALPZdWQfxgPRD7bBREukMhHOKRk6GIIwVIUn2B+AflNCvDvbh1qHsJx7EA9DIfzJrUT AAAAAAAA --------------ms020703010001000000040806-- From nobody Fri Feb 3 07:48:45 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4092A129450 for ; Fri, 3 Feb 2017 07:48:44 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ElOSakGoZSGn for ; Fri, 3 Feb 2017 07:48:42 -0800 (PST) Received: from mail-qt0-x22f.google.com (mail-qt0-x22f.google.com [IPv6:2607:f8b0:400d:c0d::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA690129437 for ; Fri, 3 Feb 2017 07:48:41 -0800 (PST) Received: by mail-qt0-x22f.google.com with SMTP id x49so42127577qtc.2 for ; Fri, 03 Feb 2017 07:48:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=68HOId4CVROxUp60dyhMyBPzHjuKvKQVJYYECqK7nBs=; b=RHm+4uxxnOFHAhS9hwfHkUWFmjvl4PHNmwFgPVeVjhGsqDtPq93WNduyYOKBsElGTG QvIur65Y2ZzOVkUQpqKGKCLfWoIa9JJiv5QcF9e+ktDKBa8i2O865M4usq0bto0D6ZVz McW+304jFp8lGGYi5jtzJTJYBasbPDDN+BeyQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=68HOId4CVROxUp60dyhMyBPzHjuKvKQVJYYECqK7nBs=; b=luyA5LdFoKM+KQvrPJUVNAOgCwy5hLv00OutbJO256Ax7pWjrzol70GWqRKhnS0LVS NtSObqnSP8FFrRENNYkk/orQfGRSBrxInER6JCWfBmbPxvWt1a7EH/m8oSLY/KYgfPzL 1IJtX40YZKOIj+2wwklcZsb1cnDQnuIJs0/5V4H43NNKIFxV7YY/O4uoPRO3LeZIjyFr 9vSJhST+5ZMVNySuWbrtLawjH+UW9jccU1dnKnmfKBarKEghYrUdlf3ZI+/3FGAnH/Oc e8TT8FiH99SUNAsg7mCTKnLd4cOlvk+WgXMu3sUNSYPJL+Oe+on6mZVM0WOcP9aVKxm0 BEBg== X-Gm-Message-State: AIkVDXJ4nX8iUE6eMjypsREMx/Z08DgmHCdcHQ63NQviaXjafV4B1uV973ofBhTgZd8ZZQ== X-Received: by 10.200.40.113 with SMTP id 46mr13220695qtr.167.1486136921048; Fri, 03 Feb 2017 07:48:41 -0800 (PST) Received: from [172.16.0.92] (pool-173-73-120-80.washdc.east.verizon.net. [173.73.120.80]) by smtp.gmail.com with ESMTPSA id z8sm24667856qkz.42.2017.02.03.07.48.38 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 03 Feb 2017 07:48:39 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: Date: Fri, 3 Feb 2017 10:48:37 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <2388DC5B-C9AC-4459-887C-8ACF7BCD2D13@sn3rd.com> References: <20170203141815.346CAB81685@rfc-editor.org> To: Stephen Farrell X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Attila.Bruncsak@itu.int, Stefan Santesson , pkix@ietf.org, RFC Errata System , philliph@comodo.com Subject: Re: [pkix] [Technical Errata Reported] RFC6844 (4922) X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 15:48:44 -0000 Yeah I mean throwing in the 2119-like "must not=E2=80=9D in there seems = more like a change to me to. spt > On Feb 3, 2017, at 09:53, Stephen Farrell = wrote: >=20 >=20 > Hi all, >=20 > That strikes me, not as an erratum, but rather as a change > request. IIRC, that specific issue was debated at the time > so the text in the RFC is not an error, no matter whether > or not one considers it a good or bad idea. >=20 > On that basis I think this ought be rejected as an erratum, > and if folks wish to fix this, they ought write an > Internet-draft that updates RFC6844 and pursue publication > of that through the normal processes. (I'd suggest the > lamps WG [1] mailing list might be a good venue for any > initial discussion as to the desirability of that kind of > thing.) >=20 > Cheers, > S. >=20 > [1] https://tools.ietf.org/wg/lamps/ >=20 >=20 > On 03/02/17 14:18, RFC Errata System wrote: >> The following errata report has been submitted for RFC6844, >> "DNS Certification Authority Authorization (CAA) Resource Record". >>=20 >> -------------------------------------- >> You may review the report below and at: >> http://www.rfc-editor.org/errata_search.php?rfc=3D6844&eid=3D4922 >>=20 >> -------------------------------------- >> Type: Technical >> Reported by: Attila Bruncs=C3=83=C2=A1k >>=20 >> Section: 4 >>=20 >> Original Text >> ------------- >> The search for a CAA record climbs the DNS name tree from the >> specified label up to but not including the DNS root '.'. >>=20 >> Corrected Text >> -------------- >> The search for a CAA record must not climb the DNS name tree from the >> specified label up. >>=20 >> Notes >> ----- >> Obviously it does not make any sense to climb up. If there would be = CAA record published for the "com" TLD, than it would make what relation = to the CAA of the "example.com" domain? =46rom an other viewpoint: all = CAs are going to check the "com" TLD for CAA record if a given = organization has no CAA record published in its own domain? >> Another, more practical example: "example.com" needs a certificate = for his top domain (https://example.com/), so it decides to publish the = CAA record to enforce the security. Doing this it may unknowingly affect = the renewal of the certificate for the wellhidden.hr.example.com where = the hr.example.com domain is under different administrative authority = than example.com domain itself. >>=20 >> Instructions: >> ------------- >> This erratum is currently posted as "Reported". If necessary, please >> use "Reply All" to discuss whether it should be verified or >> rejected. When a decision is reached, the verifying party =20 >> can log in to change the status and edit the report, if necessary.=20 >>=20 >> -------------------------------------- >> RFC6844 (draft-ietf-pkix-caa-15) >> -------------------------------------- >> Title : DNS Certification Authority Authorization (CAA) = Resource Record >> Publication Date : January 2013 >> Author(s) : P. Hallam-Baker, R. Stradling >> Category : PROPOSED STANDARD >> Source : Public-Key Infrastructure (X.509) >> Area : Security >> Stream : IETF >> Verifying Party : IESG >>=20 >=20 > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix From nobody Fri Feb 3 07:51:03 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E144B129C36; Fri, 3 Feb 2017 07:50:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.4 X-Spam-Level: X-Spam-Status: No, score=-7.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.199, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sN70geLc_TQX; Fri, 3 Feb 2017 07:50:53 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C34E2129BE6; Fri, 3 Feb 2017 07:50:53 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id B40ADB81905; Fri, 3 Feb 2017 07:50:53 -0800 (PST) To: Attila.Bruncsak@itu.int, philliph@comodo.com, rob.stradling@comodo.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Message-Id: <20170203155053.B40ADB81905@rfc-editor.org> Date: Fri, 3 Feb 2017 07:50:53 -0800 (PST) Archived-At: Cc: text/plain@rfc-editor.org, charset=UTF-8@rfc-editor.org, rfc-editor@rfc-editor.orgContent-Type, iesg@ietf.org, pkix@ietf.org Subject: [pkix] [Errata Rejected] RFC6844 (4922) X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 15:50:55 -0000 The following errata report has been rejected for RFC6844, "DNS Certification Authority Authorization (CAA) Resource Record". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6844&eid=4922 -------------------------------------- Status: Rejected Type: Technical Reported by: Attila Bruncsák Date Reported: 2017-02-03 Rejected by: Stephen Farrell (IESG) Section: 4 Original Text ------------- The search for a CAA record climbs the DNS name tree from the specified label up to but not including the DNS root '.'. Corrected Text -------------- The search for a CAA record must not climb the DNS name tree from the specified label up. Notes ----- Obviously it does not make any sense to climb up. If there would be CAA record published for the "com" TLD, than it would make what relation to the CAA of the "example.com" domain? From an other viewpoint: all CAs are going to check the "com" TLD for CAA record if a given organization has no CAA record published in its own domain? Another, more practical example: "example.com" needs a certificate for his top domain (https://example.com/), so it decides to publish the CAA record to enforce the security. Doing this it may unknowingly affect the renewal of the certificate for the wellhidden.hr.example.com where the hr.example.com domain is under different administrative authority than example.com domain itself. --VERIFIER NOTES-- This would be a change and hence is not an erratum -------------------------------------- RFC6844 (draft-ietf-pkix-caa-15) -------------------------------------- Title : DNS Certification Authority Authorization (CAA) Resource Record Publication Date : January 2013 Author(s) : P. Hallam-Baker, R. Stradling Category : PROPOSED STANDARD Source : Public-Key Infrastructure (X.509) Area : Security Stream : IETF Verifying Party : IESG From nobody Fri Feb 3 07:51:30 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2603129C60 for ; Fri, 3 Feb 2017 07:51:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.499 X-Spam-Level: X-Spam-Status: No, score=-7.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.199, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P-C2NO8gtSvN for ; Fri, 3 Feb 2017 07:51:20 -0800 (PST) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11E33129D78 for ; Fri, 3 Feb 2017 07:51:18 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 212E7BE51; Fri, 3 Feb 2017 15:51:16 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PZLDsDwfDT-U; Fri, 3 Feb 2017 15:51:16 +0000 (GMT) Received: from [134.226.36.93] (bilbo.dsg.cs.tcd.ie [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 7198DBE4C; Fri, 3 Feb 2017 15:51:15 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1486137075; bh=6Z6ln6alhQ2lwVAj9RrpKz2aPdo++to/TiqAYzTeNkY=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=AFibBeSPLakQxy5bNJtcCNIoO70Ta4m+H8Qv5eWXpS/cITvdxwhvmhV4QgnsWDkJF yVj73TsyFN9O6YLhGm/+NPWg5WViJTd63pSioz8KBCvwf6iS//Guzm/SUlYBsMkf9G EjeFn6KyZ5zMeuQqcgIJyTQuJyyp7ijlY1DLp4H4= To: Sean Turner References: <20170203141815.346CAB81685@rfc-editor.org> <2388DC5B-C9AC-4459-887C-8ACF7BCD2D13@sn3rd.com> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Fri, 3 Feb 2017 15:51:15 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <2388DC5B-C9AC-4459-887C-8ACF7BCD2D13@sn3rd.com> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms060707030008060204030601" Archived-At: Cc: Attila.Bruncsak@itu.int, Stefan Santesson , pkix@ietf.org, RFC Errata System , philliph@comodo.com Subject: Re: [pkix] [Technical Errata Reported] RFC6844 (4922) X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 15:51:28 -0000 This is a cryptographically signed message in MIME format. --------------ms060707030008060204030601 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 03/02/17 15:48, Sean Turner wrote: > Yeah I mean throwing in the 2119-like "must not=E2=80=9D in there seems= more > like a change to me to. Done. S. >=20 > spt >=20 >> On Feb 3, 2017, at 09:53, Stephen Farrell >> wrote: >>=20 >>=20 >> Hi all, >>=20 >> That strikes me, not as an erratum, but rather as a change request. >> IIRC, that specific issue was debated at the time so the text in >> the RFC is not an error, no matter whether or not one considers it >> a good or bad idea. >>=20 >> On that basis I think this ought be rejected as an erratum, and if >> folks wish to fix this, they ought write an Internet-draft that >> updates RFC6844 and pursue publication of that through the normal >> processes. (I'd suggest the lamps WG [1] mailing list might be a >> good venue for any initial discussion as to the desirability of >> that kind of thing.) >>=20 >> Cheers, S. >>=20 >> [1] https://tools.ietf.org/wg/lamps/ >>=20 >>=20 >> On 03/02/17 14:18, RFC Errata System wrote: >>> The following errata report has been submitted for RFC6844, "DNS >>> Certification Authority Authorization (CAA) Resource Record". >>>=20 >>> -------------------------------------- You may review the report >>> below and at:=20 >>> http://www.rfc-editor.org/errata_search.php?rfc=3D6844&eid=3D4922 >>>=20 >>> -------------------------------------- Type: Technical Reported >>> by: Attila Bruncs=C3=83=C2=A1k >>>=20 >>> Section: 4 >>>=20 >>> Original Text ------------- The search for a CAA record climbs >>> the DNS name tree from the specified label up to but not >>> including the DNS root '.'. >>>=20 >>> Corrected Text -------------- The search for a CAA record must >>> not climb the DNS name tree from the specified label up. >>>=20 >>> Notes ----- Obviously it does not make any sense to climb up. If >>> there would be CAA record published for the "com" TLD, than it >>> would make what relation to the CAA of the "example.com" domain? >>> From an other viewpoint: all CAs are going to check the "com" TLD >>> for CAA record if a given organization has no CAA record >>> published in its own domain? Another, more practical example: >>> "example.com" needs a certificate for his top domain >>> (https://example.com/), so it decides to publish the CAA record >>> to enforce the security. Doing this it may unknowingly affect the >>> renewal of the certificate for the wellhidden.hr.example.com >>> where the hr.example.com domain is under different administrative >>> authority than example.com domain itself. >>>=20 >>> Instructions: ------------- This erratum is currently posted as >>> "Reported". If necessary, please use "Reply All" to discuss >>> whether it should be verified or rejected. When a decision is >>> reached, the verifying party can log in to change the status and >>> edit the report, if necessary. >>>=20 >>> -------------------------------------- RFC6844 >>> (draft-ietf-pkix-caa-15) --------------------------------------=20 >>> Title : DNS Certification Authority Authorization >>> (CAA) Resource Record Publication Date : January 2013=20 >>> Author(s) : P. Hallam-Baker, R. Stradling Category >>> : PROPOSED STANDARD Source : Public-Key >>> Infrastructure (X.509) Area : Security Stream >>> : IETF Verifying Party : IESG >>>=20 >>=20 >> _______________________________________________ pkix mailing list=20 >> pkix@ietf.org https://www.ietf.org/mailman/listinfo/pkix >=20 >=20 --------------ms060707030008060204030601 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNzAyMDMx NTUxMTVaMC8GCSqGSIb3DQEJBDEiBCDZLUmGk/AHUk8kzIB0TzDheKqlxNvpQAnVu81qDgBC hDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAPpznvriIkRf6/eTgUUIINN3ULsVMmMP18JS0c8qTNrqTuP9/6cmbi S65PM1d6odmN8LWLKwOb0XoePLhdbZlLhBxlK0o1ZDfXTXkyDK4vk/Awu1bXppsO1kycYekO umZfObQVLpwAc/clUq9/s7cSM/IkEhGoPSt+VF4cQYz1Hz5ov9Rse0Bb2mJxKJj65kPeRWMH 9NRYXCg+CZhQfus2/iX4X4tS8vjy0Q2Y4AVmyK7E9IW9o2+v9c77mjFrdNoLEzn+/3Q9oN5q rSMU6bVIrZotUFfWvBT4xIYn5VHG/Zaxi9Tvvads2XFWS5Ew2/9fYJYKpeF89qG7XXBMAYzK AAAAAAAA --------------ms060707030008060204030601-- From nobody Sun Feb 5 16:48:37 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD884129D35 for ; Fri, 3 Feb 2017 06:18:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.4 X-Spam-Level: X-Spam-Status: No, score=-7.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-3.199, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LpEQeginCQ6Q for ; Fri, 3 Feb 2017 06:18:15 -0800 (PST) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F1E812944E for ; Fri, 3 Feb 2017 06:18:15 -0800 (PST) Received: by rfc-editor.org (Postfix, from userid 30) id 346CAB81685; Fri, 3 Feb 2017 06:18:15 -0800 (PST) To: philliph@comodo.com, rob.stradling@comodo.com, stephen.farrell@cs.tcd.ie, Kathleen.Moriarty.ietf@gmail.com, kent@bbn.com, stefan@aaa-sec.com X-PHP-Originating-Script: 30:errata_mail_lib.php From: RFC Errata System Message-Id: <20170203141815.346CAB81685@rfc-editor.org> Date: Fri, 3 Feb 2017 06:18:15 -0800 (PST) Archived-At: X-Mailman-Approved-At: Sun, 05 Feb 2017 16:48:36 -0800 Cc: pkix@ietf.org, Attila.Bruncsak@itu.int, rfc-editor@rfc-editor.orgContent-Type, text/plain@rfc-editor.org, charset=UTF-8@rfc-editor.org Subject: [pkix] [Technical Errata Reported] RFC6844 (4922) X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Feb 2017 14:18:17 -0000 The following errata report has been submitted for RFC6844, "DNS Certification Authority Authorization (CAA) Resource Record". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6844&eid=4922 -------------------------------------- Type: Technical Reported by: Attila Bruncsák Section: 4 Original Text ------------- The search for a CAA record climbs the DNS name tree from the specified label up to but not including the DNS root '.'. Corrected Text -------------- The search for a CAA record must not climb the DNS name tree from the specified label up. Notes ----- Obviously it does not make any sense to climb up. If there would be CAA record published for the "com" TLD, than it would make what relation to the CAA of the "example.com" domain? From an other viewpoint: all CAs are going to check the "com" TLD for CAA record if a given organization has no CAA record published in its own domain? Another, more practical example: "example.com" needs a certificate for his top domain (https://example.com/), so it decides to publish the CAA record to enforce the security. Doing this it may unknowingly affect the renewal of the certificate for the wellhidden.hr.example.com where the hr.example.com domain is under different administrative authority than example.com domain itself. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6844 (draft-ietf-pkix-caa-15) -------------------------------------- Title : DNS Certification Authority Authorization (CAA) Resource Record Publication Date : January 2013 Author(s) : P. Hallam-Baker, R. Stradling Category : PROPOSED STANDARD Source : Public-Key Infrastructure (X.509) Area : Security Stream : IETF Verifying Party : IESG From nobody Mon Feb 6 11:26:16 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE3F41295C5 for ; Mon, 6 Feb 2017 11:25:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YJhhlZXt7xff for ; Mon, 6 Feb 2017 11:25:49 -0800 (PST) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D00C11295DA for ; Mon, 6 Feb 2017 11:25:43 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id 27E71300429 for ; Mon, 6 Feb 2017 14:25:43 -0500 (EST) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id otrXeKrk4wTb for ; Mon, 6 Feb 2017 14:25:41 -0500 (EST) Received: from [192.168.2.100] (pool-108-45-101-150.washdc.fios.verizon.net [108.45.101.150]) by mail.smeinc.net (Postfix) with ESMTPSA id 89202300254; Mon, 6 Feb 2017 14:25:40 -0500 (EST) Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <20170203141815.346CAB81685@rfc-editor.org> Date: Mon, 6 Feb 2017 14:25:39 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20170203141815.346CAB81685@rfc-editor.org> To: Phillip Hallam-Baker , Rob Stradling X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF PKIX , Attila.Bruncsak@itu.int Subject: Re: [pkix] [Technical Errata Reported] RFC6844 (4922) X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Feb 2017 19:25:51 -0000 I suspect that the document says what the authors intended. Please = confirm. Russ On Feb 3, 2017, at 9:18 AM, RFC Errata System = wrote: > The following errata report has been submitted for RFC6844, > "DNS Certification Authority Authorization (CAA) Resource Record". >=20 > -------------------------------------- > You may review the report below and at: > http://www.rfc-editor.org/errata_search.php?rfc=3D6844&eid=3D4922 >=20 > -------------------------------------- > Type: Technical > Reported by: Attila Bruncs=E1k >=20 > Section: 4 >=20 > Original Text > ------------- > The search for a CAA record climbs the DNS name tree from the > specified label up to but not including the DNS root '.'. >=20 > Corrected Text > -------------- > The search for a CAA record must not climb the DNS name tree from the > specified label up. >=20 > Notes > ----- > Obviously it does not make any sense to climb up. If there would be = CAA record published for the "com" TLD, than it would make what relation = to the CAA of the "example.com" domain? =46rom an other viewpoint: all = CAs are going to check the "com" TLD for CAA record if a given = organization has no CAA record published in its own domain? > Another, more practical example: "example.com" needs a certificate for = his top domain (https://example.com/), so it decides to publish the CAA = record to enforce the security. Doing this it may unknowingly affect the = renewal of the certificate for the wellhidden.hr.example.com where the = hr.example.com domain is under different administrative authority than = example.com domain itself. >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC6844 (draft-ietf-pkix-caa-15) > -------------------------------------- > Title : DNS Certification Authority Authorization (CAA) = Resource Record > Publication Date : January 2013 > Author(s) : P. Hallam-Baker, R. Stradling > Category : PROPOSED STANDARD > Source : Public-Key Infrastructure (X.509) > Area : Security > Stream : IETF > Verifying Party : IESG >=20 > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix From nobody Tue Feb 21 07:33:23 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D881129409 for ; Tue, 21 Feb 2017 07:33:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aiLeQjOiAFN3 for ; Tue, 21 Feb 2017 07:33:20 -0800 (PST) Received: from mail-oi0-x233.google.com (mail-oi0-x233.google.com [IPv6:2607:f8b0:4003:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D965A129C1A for ; Tue, 21 Feb 2017 07:33:19 -0800 (PST) Received: by mail-oi0-x233.google.com with SMTP id 62so55090708oih.2 for ; Tue, 21 Feb 2017 07:33:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=acku8b6nrP94YANCmPC9ntB3ArJ32n70neNWIYEa68M=; b=LJ6HhTCnQZXggFf6nc30uirVq5Mvu5GpgF5K2PoFEojZ3qcIHy2f3SoG+3dyUWW6dA syA4Qf1fo6wco41YHWxqNK7rVUqbA2ooWLgSz073NOFI3Lz9NuWSOJX0N5ZV4BOz+m/n xuVJ8vHyu5+3dxIv2UJ9rRY5+cGoHB8Y/jDVr0IoiYpzJzxkjW2WacPpz+117lo6soNo MEgfOAmt4GxL/PwWuWrOnlP6eRonqeSHiFt7IiMwJQ3JrW9im6Xd1Krk+9pPF2feyP7G Y2m9wFDl8uTytBjwIWEosdcG7VSFNaCb2QnJFKyDoLle/NCp4lDhNFIcFQPaTjODk2xs KTyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=acku8b6nrP94YANCmPC9ntB3ArJ32n70neNWIYEa68M=; b=oojwOptxCcJ8J1/ImN45GZqIPw/wHbbB/jcoHxjDdAhGgt6gwHwgOXx6fjyp+vF+ET doXTYmDNnAElp07dEkjerRTajNMGvpfn1X76cOMnlCkdSRp+1oeBhZ9HwO3lKMSJOJ4+ qb2l35fBD1IthgKsXpGps8KpVWl7KIWcEtlA3ltZONfB//5PtRV9Mczw/o8PEq54Yuo3 jCFWel/idabUNPbRPKydDs4FsEc1z8Y0RIOiZ2Prw+Pk4kXqvG/hJfIS54GPX5YbJryh vJ03pFkVHChv2dLvK4gRooPXrQTAYB1uq27HrG6xNWIdyTg9Z2/9fRA/XWHwBZFunXFY e8jw== X-Gm-Message-State: AMke39lxxL+8H2789g65YFVXvTWWBeyMta0Jy2JVYZ3Ccn/nwnzzONEz5mjfIeL9EYAduFFi/dbvhA2YiX0zPg== X-Received: by 10.202.8.197 with SMTP id 188mr15390199oii.22.1487691199164; Tue, 21 Feb 2017 07:33:19 -0800 (PST) MIME-Version: 1.0 Received: by 10.157.1.228 with HTTP; Tue, 21 Feb 2017 07:33:18 -0800 (PST) From: Peter Bowen Date: Tue, 21 Feb 2017 07:33:18 -0800 Message-ID: To: PKIX , Directory list Content-Type: text/plain; charset=UTF-8 Archived-At: Subject: [pkix] X.500 Edition 8 modules X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 15:33:21 -0000 Does anyone know if the collected ASN.1 modules from edition 8 have been posted? http://www.x500standard.com/index.php?n=Ig.Asn1 only has edition 7. Thanks, Peter From nobody Tue Feb 21 08:04:55 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DC40129C33 for ; Tue, 21 Feb 2017 08:04:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.619 X-Spam-Level: X-Spam-Status: No, score=-2.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gPtimptYAALT for ; Tue, 21 Feb 2017 08:04:52 -0800 (PST) Received: from mail02.dandomain.dk (mail02.dandomain.dk [194.150.112.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B9573129669 for ; Tue, 21 Feb 2017 08:04:49 -0800 (PST) Received: from Morten ([62.44.135.84]) by mail02.dandomain.dk (DanDomain Mailserver) with ASMTP id 2201702211704447324; Tue, 21 Feb 2017 17:04:44 +0100 From: "Erik Andersen" To: "'Peter Bowen'" , "'PKIX'" , "'Directory list'" References: In-Reply-To: Date: Tue, 21 Feb 2017 17:04:44 +0100 Message-ID: <001301d28c5c$37983ed0$a6c8bc70$@x500.eu> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQGY/rDTfwMD4Ic2LA5I912VdS6PWKHmut1g Content-Language: en-gb Archived-At: Subject: Re: [pkix] X.500 Edition 8 modules X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 16:04:54 -0000 I will post them tomorrow. Kind regards, Erik -----Oprindelig meddelelse----- Fra: pkix [mailto:pkix-bounces@ietf.org] P=E5 vegne af Peter Bowen Sendt: 21 February 2017 16:33 Til: PKIX ; Directory list Emne: [pkix] X.500 Edition 8 modules Does anyone know if the collected ASN.1 modules from edition 8 have been posted? http://www.x500standard.com/index.php?n=3DIg.Asn1 only has = edition 7. Thanks, Peter _______________________________________________ pkix mailing list pkix@ietf.org https://www.ietf.org/mailman/listinfo/pkix From nobody Tue Feb 21 08:09:14 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9B06129C4A for ; Tue, 21 Feb 2017 08:09:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jAaaZXYUopPK for ; Tue, 21 Feb 2017 08:09:12 -0800 (PST) Received: from mail-oi0-x22e.google.com (mail-oi0-x22e.google.com [IPv6:2607:f8b0:4003:c06::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3871129658 for ; Tue, 21 Feb 2017 08:09:11 -0800 (PST) Received: by mail-oi0-x22e.google.com with SMTP id 65so6451713oig.1 for ; Tue, 21 Feb 2017 08:09:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=wFBgusgCm6ORekb1L0+XmS1YP2WiANUwHhvP9IfQK1M=; b=YAfchpp8QDjF1LQUyt3fpuHqTMWbBtnVOY85C3PfzsRtO1ZjGSQ8JCy1MDfahx6uVs QiCx66imfcsEYyUp9oumIZvjOIwIZ7/DcBcVWxZ3MQAQQQG30ggmYTwag3zy59yvrOIg /lUxwP565RpfECW+QvH7izekcLoIeiSjcggvX+tik2VfKJZM01l0/YY0E+V4tEFRHpTk aSAd8+npvVxPq1Zs8YbwbKyQRw8l+/mEWsfd80ynSO8ka4h+51ma7hNsKinRszdPLdDH mHLORkrjtjP5whdK4NU+mTISqTSSNXOTmJR+WOw2zeHJ35IhQTNaWumF+kDIG8F4EtJw PiLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=wFBgusgCm6ORekb1L0+XmS1YP2WiANUwHhvP9IfQK1M=; b=OY/CndeAiBiDIw9CLcGtCq2wP1K/mLnTgAhZe6jqKowZZ39WvAchWwAFw/gBvv8RP2 4ZrZemobikKw/7dRjWiOjE4TLKoXzJJVKQ1zPRUv+ssdX+smXLFSNgvRMqgyIhIVQiUX C2SdPj5fEpwKZz+AURVVIh1MTSaPnxvsekWGp4Y+GbMf3X5TosLkIqyyHGJbsfbGjUj2 bTulZkiOr8f9JaS2M6k5RWT1+xijXOZHZLOXm8dVdVLeSC29CWhPTKUXJjiDNg1SvHYa SqBRuWr5e5mfsqyBUQ5dwkobfTnjdqH7/S+Fco2BpOeiM90ojW4uSXv/t68SYzsvuiOv 0NWw== X-Gm-Message-State: AMke39m9FoHoKjkSwgMJSw6qtitOp1N+46FAACIUDjXC/GBVPeF5PKYsBaATK7nPB9TQQDKfGzq2KxAKnk5K5Q== X-Received: by 10.202.85.81 with SMTP id j78mr9512552oib.100.1487693351104; Tue, 21 Feb 2017 08:09:11 -0800 (PST) MIME-Version: 1.0 Received: by 10.157.1.228 with HTTP; Tue, 21 Feb 2017 08:09:10 -0800 (PST) In-Reply-To: <001301d28c5c$37983ed0$a6c8bc70$@x500.eu> References: <001301d28c5c$37983ed0$a6c8bc70$@x500.eu> From: Peter Bowen Date: Tue, 21 Feb 2017 08:09:10 -0800 Message-ID: To: Erik Andersen Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: PKIX , Directory list Subject: Re: [pkix] X.500 Edition 8 modules X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 21 Feb 2017 16:09:14 -0000 Do you know if edition 8 adds a definition for "passwordAttribute"? It is undefined in edition 7 yet used in InformationFramework. On Tue, Feb 21, 2017 at 8:04 AM, Erik Andersen wrote: > I will post them tomorrow. > > Kind regards, > > Erik > > -----Oprindelig meddelelse----- > Fra: pkix [mailto:pkix-bounces@ietf.org] P=C3=A5 vegne af Peter Bowen > Sendt: 21 February 2017 16:33 > Til: PKIX ; Directory list > Emne: [pkix] X.500 Edition 8 modules > > Does anyone know if the collected ASN.1 modules from edition 8 have been > posted? http://www.x500standard.com/index.php?n=3DIg.Asn1 only has editi= on 7. > > Thanks, > Peter > > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix > From nobody Wed Feb 22 03:36:06 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF2651296F9 for ; Wed, 22 Feb 2017 03:36:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xIRS8LH27xxf for ; Wed, 22 Feb 2017 03:36:02 -0800 (PST) Received: from mail03.dandomain.dk (mail03.dandomain.dk [194.150.112.203]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EFAF1296F4 for ; Wed, 22 Feb 2017 03:36:01 -0800 (PST) Received: from Morten ([62.44.135.84]) by mail03.dandomain.dk (DanDomain Mailserver) with ASMTP id 3201702221235599238; Wed, 22 Feb 2017 12:35:59 +0100 From: "Erik Andersen" To: "'Peter Bowen'" References: <001301d28c5c$37983ed0$a6c8bc70$@x500.eu> In-Reply-To: Date: Wed, 22 Feb 2017 12:35:59 +0100 Message-ID: <001b01d28cff$d6b91a90$842b4fb0$@x500.eu> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQGY/rDTfwMD4Ic2LA5I912VdS6PWAGyGo0LAnFhdSWhxuYJYA== Content-Language: en-gb Archived-At: Cc: 'PKIX' , 'Directory list' Subject: Re: [pkix] X.500 Edition 8 modules X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Feb 2017 11:36:05 -0000 Hi Peter, I am quite sure, such a definition was not added. I will look into the = matter and possibly issue a defect report. Kind regards, Erik -----Oprindelig meddelelse----- Fra: Peter Bowen [mailto:pzbowen@gmail.com]=20 Sendt: 21 February 2017 17:09 Til: Erik Andersen Cc: PKIX ; Directory list Emne: Re: [pkix] X.500 Edition 8 modules Do you know if edition 8 adds a definition for "passwordAttribute"? It is undefined in edition 7 yet used in InformationFramework. On Tue, Feb 21, 2017 at 8:04 AM, Erik Andersen wrote: > I will post them tomorrow. > > Kind regards, > > Erik > > -----Oprindelig meddelelse----- > Fra: pkix [mailto:pkix-bounces@ietf.org] P=C3=A5 vegne af Peter Bowen > Sendt: 21 February 2017 16:33 > Til: PKIX ; Directory list > Emne: [pkix] X.500 Edition 8 modules > > Does anyone know if the collected ASN.1 modules from edition 8 have=20 > been posted? http://www.x500standard.com/index.php?n=3DIg.Asn1 only = has edition 7. > > Thanks, > Peter > > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix > From nobody Wed Feb 22 07:24:33 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97348129A24 for ; Wed, 22 Feb 2017 07:24:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YkRv_ctNTuXy for ; Wed, 22 Feb 2017 07:24:28 -0800 (PST) Received: from mail-oi0-x234.google.com (mail-oi0-x234.google.com [IPv6:2607:f8b0:4003:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87C161299F7 for ; Wed, 22 Feb 2017 07:24:28 -0800 (PST) Received: by mail-oi0-x234.google.com with SMTP id s205so3111732oif.3 for ; Wed, 22 Feb 2017 07:24:28 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=mP6JR3xF33Wswd5yQpqbxp0ictewopwEqi14T/QSxSE=; b=W6IScfHGbk2vrEEER7lOqjm0AE92f7jUSNh62Xwl8XwDB69xLCtONMztD7pr8mKzBx 5xpCN/0xUdTsjsjQBxqckT9ZyTqub5cSKb5TDhlGBuPCQCU1AFGG/P2litRb2B4caYT/ T5oggZnjTZJlx0el2pt5WtLRV7kh3RsT8EQITpxDn2vz9WMVAcn1sM1X9AGCTsM0loXV sZ6f0VCUnjLOoJrvi4rLWv5fipKhnCdn6q64x3uiTl4S7yxrVcJNec6pPyjGwoFcyYXX ki9RlrSErQdtdY9mqnOo6EK+m6rvG+sDKhGMFwBQW5j0WHJ5qGHiQ3k2CIAQT3BH5YLn heyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=mP6JR3xF33Wswd5yQpqbxp0ictewopwEqi14T/QSxSE=; b=qTAHVZSOvIy2sVDIgzwAIZD/mHF690BPf8RMOWvSx/WcbsA+rS5wOhXi4D8f8eIU+C tCJGbxSX8StkYjRnP6TbwhVKDNdBABEUgx2cgbv+vObhE3/pgyscD/Vh48xjpo9jjKCW yaxpftWevc5D+XXae6h/ut8S+veRprDDmShynTfnHqZiWvDL93O+hTmFNAH1YVVEzDcQ 6G9/nsN44cvmERqo0rDM63cN4iOe4f3SyAtcxxErfZwRb1WDbgzYHTeutPeNV7cCdKcz FiveHcEeTQi8RZ97pPqGOSnebcnAVhy3OVYXZuCfNoSN9jHA7ilnBKH5tKYBkUClXBbG AWvQ== X-Gm-Message-State: AMke39ndApu/7Guw/Rln/eu55PwGJzOvrQnIoKLX4Hcl3zSpQm7LRcT0q7ch5TvbJn7CsXRZxntg2W9MUek34A== X-Received: by 10.202.8.197 with SMTP id 188mr18464119oii.22.1487777067866; Wed, 22 Feb 2017 07:24:27 -0800 (PST) MIME-Version: 1.0 Received: by 10.157.1.228 with HTTP; Wed, 22 Feb 2017 07:24:27 -0800 (PST) In-Reply-To: <001b01d28cff$d6b91a90$842b4fb0$@x500.eu> References: <001301d28c5c$37983ed0$a6c8bc70$@x500.eu> <001b01d28cff$d6b91a90$842b4fb0$@x500.eu> From: Peter Bowen Date: Wed, 22 Feb 2017 07:24:27 -0800 Message-ID: To: Erik Andersen Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: PKIX , Directory list Subject: Re: [pkix] X.500 Edition 8 modules X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Feb 2017 15:24:31 -0000 Erik, It appears that there is a bug in the ASN.1 compiler I'm using. There is not supposed to be a definition of passwordAttribute; it is a parameter name. Thanks, Peter On Wed, Feb 22, 2017 at 3:35 AM, Erik Andersen wrote: > Hi Peter, > > I am quite sure, such a definition was not added. I will look into the ma= tter and possibly issue a defect report. > > Kind regards, > > Erik > > -----Oprindelig meddelelse----- > Fra: Peter Bowen [mailto:pzbowen@gmail.com] > Sendt: 21 February 2017 17:09 > Til: Erik Andersen > Cc: PKIX ; Directory list > Emne: Re: [pkix] X.500 Edition 8 modules > > Do you know if edition 8 adds a definition for "passwordAttribute"? > It is undefined in edition 7 yet used in InformationFramework. > > On Tue, Feb 21, 2017 at 8:04 AM, Erik Andersen wrote: >> I will post them tomorrow. >> >> Kind regards, >> >> Erik >> >> -----Oprindelig meddelelse----- >> Fra: pkix [mailto:pkix-bounces@ietf.org] P=C3=A5 vegne af Peter Bowen >> Sendt: 21 February 2017 16:33 >> Til: PKIX ; Directory list >> Emne: [pkix] X.500 Edition 8 modules >> >> Does anyone know if the collected ASN.1 modules from edition 8 have >> been posted? http://www.x500standard.com/index.php?n=3DIg.Asn1 only has= edition 7. >> >> Thanks, >> Peter >> >> _______________________________________________ >> pkix mailing list >> pkix@ietf.org >> https://www.ietf.org/mailman/listinfo/pkix >> > From nobody Thu Feb 23 15:44:11 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26517129C38 for ; Thu, 23 Feb 2017 15:44:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2tBmpKwB1DUm for ; Thu, 23 Feb 2017 15:44:08 -0800 (PST) Received: from mail-qk0-x22f.google.com (mail-qk0-x22f.google.com [IPv6:2607:f8b0:400d:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52153129C3D for ; Thu, 23 Feb 2017 15:44:08 -0800 (PST) Received: by mail-qk0-x22f.google.com with SMTP id s186so6307151qkb.1 for ; Thu, 23 Feb 2017 15:44:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B84gE46mxJAJnxcZCLEu7ebZOEkMXheFjEYXz4iQOiU=; b=EKy/miO5SukdnLx4CSOByZy1ycntaFbBkh8ra5CBGwO/aRuzjSsbg8G3ggUThmB9J0 40h+SzThYAnopgnsjTcr+uPkCAZSVE4bA35FLx28Wc8sSIrJOulUdCnuu9zb/CurGU3n u+OrAQz90ffcvhb3BHOSktk/t0BMcPelaqZjs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=B84gE46mxJAJnxcZCLEu7ebZOEkMXheFjEYXz4iQOiU=; b=Ll7efLO3UgwK0iaz71C4bQKBcdX2lT/5DUO+ITJALVy/4VLYwXaACQYJ9RTrmAtgkJ 2Mkaxxu0ozdQzRbx2UlQv1hbRSgzvVE4IXYHbUKzoN28nSHaWMk0V4NEZbgw6hwKkrqF bltFVGooVP3FIwv1Orxd02UiqnpxxUAC4XDOJCyji9TB1aHWdf0x7qJmpEIKo0PTAo7o UF+FLIg6C05WNqF1renlwoGYW32Oc8o9qQ7hZvSI/NMwdXaHMgWBtbb9G+HNYD0yYkqe HYb6NibuHCwBu5KSMn3yLDq3sGQOPNJTQLesokOqg7/BldiD6aHmCT2LPfIddyY6gRU4 ju+g== X-Gm-Message-State: AMke39mKlPngSgAkSX7tQPXz1BCh73xpKzLUeDV19Ov99KN+Rjr4/ATtqO5Pq0fErKuPsg== X-Received: by 10.55.122.130 with SMTP id v124mr36175012qkc.19.1487893447523; Thu, 23 Feb 2017 15:44:07 -0800 (PST) Received: from [172.16.0.92] ([96.231.229.68]) by smtp.gmail.com with ESMTPSA id o16sm3651318qkl.67.2017.02.23.15.44.06 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 23 Feb 2017 15:44:06 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: Date: Thu, 23 Feb 2017 18:44:05 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <569390A5-1FFC-42EC-85FA-ACFA3AC0A603@sn3rd.com> References: <001301d28c5c$37983ed0$a6c8bc70$@x500.eu> <001b01d28cff$d6b91a90$842b4fb0$@x500.eu> To: Peter Bowen , Erik Andersen X-Mailer: Apple Mail (2.3124) Archived-At: Cc: PKIX , Directory list Subject: Re: [pkix] X.500 Edition 8 modules X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Feb 2017 23:44:10 -0000 Maybe "passwordAttribute=E2=80=9D in pwdHistory/PwdHistory, = pwdRecentlyExpired, and pwdHistoryMatch is supposed to = =E2=80=9CpwdAttribute=E2=80=9D to match the object class and attribute = both of which are defined in the module: = https://www.itu.int/ITU-T/formal-language/itu-t/x/x501/2012/InformationFra= mework.html spt > On Feb 22, 2017, at 10:24, Peter Bowen wrote: >=20 > Erik, >=20 > It appears that there is a bug in the ASN.1 compiler I'm using. There > is not supposed to be a definition of passwordAttribute; it is a > parameter name. >=20 > Thanks, > Peter >=20 > On Wed, Feb 22, 2017 at 3:35 AM, Erik Andersen wrote: >> Hi Peter, >>=20 >> I am quite sure, such a definition was not added. I will look into = the matter and possibly issue a defect report. >>=20 >> Kind regards, >>=20 >> Erik >>=20 >> -----Oprindelig meddelelse----- >> Fra: Peter Bowen [mailto:pzbowen@gmail.com] >> Sendt: 21 February 2017 17:09 >> Til: Erik Andersen >> Cc: PKIX ; Directory list >> Emne: Re: [pkix] X.500 Edition 8 modules >>=20 >> Do you know if edition 8 adds a definition for "passwordAttribute"? >> It is undefined in edition 7 yet used in InformationFramework. >>=20 >> On Tue, Feb 21, 2017 at 8:04 AM, Erik Andersen wrote: >>> I will post them tomorrow. >>>=20 >>> Kind regards, >>>=20 >>> Erik >>>=20 >>> -----Oprindelig meddelelse----- >>> Fra: pkix [mailto:pkix-bounces@ietf.org] P=C3=A5 vegne af Peter = Bowen >>> Sendt: 21 February 2017 16:33 >>> Til: PKIX ; Directory list = >>> Emne: [pkix] X.500 Edition 8 modules >>>=20 >>> Does anyone know if the collected ASN.1 modules from edition 8 have >>> been posted? http://www.x500standard.com/index.php?n=3DIg.Asn1 only = has edition 7. >>>=20 >>> Thanks, >>> Peter >>>=20 >>> _______________________________________________ >>> pkix mailing list >>> pkix@ietf.org >>> https://www.ietf.org/mailman/listinfo/pkix >>>=20 >>=20 >=20 > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix