Subject: [sidr] [Technical Errata Reported] RFC6487 (3168)

From: RFC Errata System <[email-masked]>
Date: Mon, 26 Mar 2012 13:41:37 -0700 (PDT)

The following errata report has been submitted for RFC6487,
"A Profile for X.509 PKIX Resource Certificates".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6487&eid=3168

--------------------------------------
Type: Technical
Reported by: David Mandelberg <[email-masked]>

Section: 4.8

Original Text
-------------
   or non-critical.  A certificate-using system MUST reject the
   certificate if it encounters a critical extension it does not
   recognize; however, a non-critical extension MAY be ignored if it is
   not recognized [RFC5280].

Corrected Text
--------------
   or non-critical.  A certificate-using system MUST reject the
   certificate if it encounters an extension not explicitly mentioned
   in this document.  This is in contrast to RFC 5280 which allows
   non-critical extensions to be ignored.

Notes
-----
Other sections of the same document contradict the original section 4.8:

Section 1:

   Any extensions not explicitly mentioned MUST be absent.  The same
   applies to the CRLs used in the RPKI, that are also profiled in this
   document.

Section 8:

   Certificate Extensions:
         This profile does not permit the use of any other critical or
         non-critical extensions.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6487 (draft-ietf-sidr-res-certs-22)
--------------------------------------
Title               : A Profile for X.509 PKIX Resource Certificates
Publication Date    : February 2012
Author(s)           : G. Huston, G. Michaelson, R. Loomans
Category            : PROPOSED STANDARD
Source              : Secure Inter-Domain Routing
Area                : Routing
Stream              : IETF
Verifying Party     : IESG

---

From: Robert Loomans <[email-masked]>
Date: Tue, 27 Mar 2012 08:59:02 +1000

I believe this errata is accurate: the intention was to limit extensions to only those mentioned in RFC.

Rob

-- 
Robert Loomans                         email:       [email-masked]
Senior Software Engineer, APNIC        sip:    [email-masked]
http://www.apnic.net/                  phone:         +61 7 3858 3100

---

From: Geoff Huston <[email-masked]>
Date: Tue, 27 Mar 2012 14:33:07 +1100

> can log in to change the status and edit the report, if necessary. 

verified.

Geoff

--

Geoff Huston
Chief Scientist, APNIC

+61 7 3858 3100
[email-masked]

---

From: "Murphy, Sandra" <[email-masked]>
Date: Tue, 27 Mar 2012 06:38:17 +0000

Thank you, Geoff.   I agree.

--Sandy

________________________________________
From: Geoff Huston [[email-masked]]
Sent: Monday, March 26, 2012 11:33 PM
To: RFC Errata System
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]; Murphy, Sandra; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Technical Errata Reported] RFC6487 (3168)

verified.

Geoff

--

Geoff Huston
Chief Scientist, APNIC

+61 7 3858 3100
[email-masked]

---

From: "Murphy, Sandra" <[email-masked]>
Date: Tue, 27 Mar 2012 06:42:26 +0000

--Sandy

verified.

Geoff

--

Geoff Huston
Chief Scientist, APNIC

+61 7 3858 3100
[email-masked]