Subject: [sidr] [Technical Errata Reported] RFC6487 (3238)

From: RFC Errata System <[email-masked]>
Date: Thu, 31 May 2012 07:55:43 -0700 (PDT)

The following errata report has been submitted for RFC6487,
"A Profile for X.509 PKIX Resource Certificates".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6487&eid=3238

--------------------------------------
Type: Technical
Reported by: Stephen Kent <[email-masked]>

Section: 6.3

Original Text
-------------
 ExtendedKeyUsage
         The CA MAY honor ExtendedKeyUsage extensions of keyCertSign and
         cRLSign if present, as long as this is consistent with the
         BasicConstraints SubjectType sub-field, when specified.

Corrected Text
--------------
 ExtendedKeyUsage
         The CA MAY honor ExtendedKeyUsage extensions in requests for EE
         certificates that are issued to routers or other devices, consistent with values
         specified in Standards Track RFCs that adopt this profile and that identify
         application-specific requirements that motivate the use of such EKUs.

Notes
-----
The current text appears to be the result of a "cut and paste" error. It is essentially identical to the text 
for the Key Usage extension, and names two fields that appear in that extension, not in an EKU extension. The text I propose above parallels what appears in Section 4.8.5, which describes how an
 EKU MAY be used in RPKI certificates.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6487 (draft-ietf-sidr-res-certs-22)
--------------------------------------
Title               : A Profile for X.509 PKIX Resource Certificates
Publication Date    : February 2012
Author(s)           : G. Huston, G. Michaelson, R. Loomans
Category            : PROPOSED STANDARD
Source              : Secure Inter-Domain Routing
Area                : Routing
Stream              : IETF
Verifying Party     : IESG

---

From: "Roque Gagliano (rogaglia)" <[email-masked]>
Date: Thu, 31 May 2012 15:29:17 +0000

Hi Steve,

> "A Profile for X.509 PKIX Resource Certificates".

I agree that this correction make sense. I also agree on the restriction to uses that are compatible with this profile rather than the complete registry list. We already have RFC 6494 as example.

Roque

> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Randy Bush <[email-masked]>
Date: Fri, 01 Jun 2012 07:55:46 +0900

>> EKU MAY be used in RPKI certificates.

while i agree that the change is correct, this is not an erratum, but an
actual change in semantics.

randy