Yes, I like Bruce’s rewrite better.
Using MAY to describe exceptions to MUST is common in some standards (including the BRs in places), but strictly speaking it’s a violation of RFC 2119 and we should (MUST? 😊) fix them when we find them. “MUST do X and MAY do Y instead” is just wrong. A MUST requirement is an absolute requirement. Providing a MAY for a replacement option introduces a contradiction, not an exception. -Tim From: Cscwg-public <[email protected]> On Behalf Of Bruce Morton via Cscwg-public Sent: Wednesday, November 22, 2023 12:03 PM To: Martijn Katerbarg <[email protected]>; [email protected] Subject: Re: [Cscwg-public] MUST overridden by a MAY - Subordinate CA policies Hi Martijn, I agree that the language needs improvement. It might be better if the requirement was: A Certificate issued after 31 March 2022 to a Subordinate CA that issues Timestamp Certificates and is an Affiliate of the Issuing CA MUST include one of the following: 1. The CA/Browser Forum reserved identifier (2.23.140.1.4.2) to indicate the Subordinate CA’s compliance with these Requirements; OR 2. The “anyPolicy” identifier (2.5.29.32.0). Does that work? If so, then maybe we should also cleanup the whole section. Also, we might also consider deleting “to indicate the Subordinate CA’s compliance with these Requirements”. Thanks, Bruce. From: Cscwg-public <[email protected] <mailto:[email protected]> > On Behalf Of Martijn Katerbarg via Cscwg-public Sent: Wednesday, November 22, 2023 11:07 AM To: [email protected] <mailto:[email protected]> Subject: [EXTERNAL] [Cscwg-public] MUST overridden by a MAY - Subordinate CA policies All, CSBR section 7.1.6.3 states: ”A Certificate issued to a Subordinate CA that issues Code Signing Certificates and is an Affiliate of the Issuing CA: 1. MUST include the CA/Browser Forum reserved identifier specified in Section 7.1.6.1 <https://url.avanan.click/v2/___https:/github.com/cabforum/code-signing/blob/main/docs/CSBR.md%237161-reserved-certificate-policy-identifiers___.YXAzOmRpZ2ljZXJ0OmE6bzphZDZmYjdhNGUxNjE2YWYzMGY3MmJkNzdjOGUyMTNlMTo2OmZiZWE6ZmFkNDJkNDllOWM5ZTVjNjVmNmJkY2RkMzQyY2YyMmFiZjJmODJhOTFhYzY5YzNiY2VhMjZiNjQ2ZGNlMjU4MzpoOkY> to indicate the Subordinate CA's compliance with these Requirements, and 2. MAY contain the "anyPolicy" identifier (2.5.29.32.0) in place of an explicit policy identifier. A Certificate issued after 31 March 2022 to a Subordinate CA that issues Timestamp Certificates and is an Affiliate of the Issuing CA: 1. MUST include the CA/Browser Forum reserved identifier specified in Section 7.1.6.1 <https://url.avanan.click/v2/___https:/github.com/cabforum/code-signing/blob/main/docs/CSBR.md%237161-reserved-certificate-policy-identifiers___.YXAzOmRpZ2ljZXJ0OmE6bzphZDZmYjdhNGUxNjE2YWYzMGY3MmJkNzdjOGUyMTNlMTo2OmQzYjQ6NGQzNTc4ZDUxOWExZDZlOTQ3M2M2YWM2MjQxMjBjZDZjMzBlOWNiODA4MDZhODNiYmYzZTM1YmQ5NWJiNDY3NjpoOkY> to indicate the Subordinate CA’s compliance with these Requirements, and 2. MAY contain the “anyPolicy” identifier (2.5.29.32.0) in place of an explicit policy identifier.” I find there’s a few issues with this: * “MUST include the CA/Browser Forum reserved identifier specified in Section 7.1.6.1 <https://url.avanan.click/v2/___https:/github.com/cabforum/code-signing/blob/main/docs/CSBR.md%237161-reserved-certificate-policy-identifiers___.YXAzOmRpZ2ljZXJ0OmE6bzphZDZmYjdhNGUxNjE2YWYzMGY3MmJkNzdjOGUyMTNlMTo2OjhiNjM6MzI3NzY3ZjlhMDc3YTIyNzZjOWY3MjgxNjA1YjVjZDFhODk4Y2NmNzBkYzA1MTdiNThkNTgxOGY3ZmE2MTliYTpoOkY> ”, seems to state there’s only one policy OID to use, while in fact there are 3 in the named section, 2 which are for code signing certificates. This is a minor issue though and could be fixed in a cleanup ballot. * More concerning I find the MUST and MAY language. If we take the language related to CA Certificates for Code Signing Certificates, what does this language actually state? Should this be interpreted as: * MUST include a CABF OID and MAY additionally contain the “anyPolicy” OID. or does it state: * MUST include either a CABF OID or the “anyPolicy” OID? I would like to think the intent here is to allow CA Certificates with just the “anyPolicy” OID, but at the same time, a MAY overriding a MUST, seems counterproductive. Any thoughts on this? Regards, Martijn Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Cscwg-public mailing list [email protected] https://lists.cabforum.org/mailman/listinfo/cscwg-public
