Hi,
The extended key usages id-kp-ipsecEndSystem, id-kp-ipsecTunnel and
id-kp-ipsecUser are obsoleted as per RFC 4945 ยง 5.1.3.12 section title
"ExtendedKeyUsage":
... Note that there were three IPsecrelated object identifiers in EKU
that were assigned in 1999. The semantics of these values were never
clearly defined. The use of these three EKU values in IKE/IPsec is
obsolete and explicitly deprecated by this specification. CAs SHOULD NOT
issue certificates for use in IKE with them. (For historical reference
only, those values were id-kp-ipsecEndSystem, id-kp-ipsecTunnel, and
id-kpipsecUser.) ...
I believe that the attached patch removes these extendedkey usages to
comply with the SHOULD NOT assertion in RFC 4945.
Note: A new extended key usage has been created for the Internet Key
Exchange (IKE) called id-kp-ipsecIKE has been added. A follow-up issue
will be created for that.
Micah
diff --git a/crypto/objects/obj_dat.h b/crypto/objects/obj_dat.h
index fe46624..e2345fb 100644
--- a/crypto/objects/obj_dat.h
+++ b/crypto/objects/obj_dat.h
@@ -334,9 +336,6 @@ static const unsigned char lvalues[5824]={
0x2B,0x06,0x01,0x05,0x05,0x07,0x01,0x08, /* [2129] OBJ_sbgp_autonomousSysNum */
0x2B,0x06,0x01,0x05,0x05,0x07,0x01,0x09, /* [2137] OBJ_sbgp_routerIdentifier */
0x2B,0x06,0x01,0x05,0x05,0x07,0x02,0x03, /* [2145] OBJ_textNotice */
-0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x05, /* [2153] OBJ_ipsecEndSystem */
-0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x06, /* [2161] OBJ_ipsecTunnel */
-0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x07, /* [2169] OBJ_ipsecUser */
0x2B,0x06,0x01,0x05,0x05,0x07,0x03,0x0A, /* [2177] OBJ_dvcs */
0x2B,0x06,0x01,0x05,0x05,0x07,0x04,0x01, /* [2185] OBJ_id_it_caProtEncCert */
0x2B,0x06,0x01,0x05,0x05,0x07,0x04,0x02, /* [2193] OBJ_id_it_signKeyPairTypes */
@@ -1357,10 +1358,6 @@ static const ASN1_OBJECT nid_objs[NUM_NID]={
{"sbgp-routerIdentifier","sbgp-routerIdentifier",
NID_sbgp_routerIdentifier,8,&(lvalues[2137]),0},
{"textNotice","textNotice",NID_textNotice,8,&(lvalues[2145]),0},
-{"ipsecEndSystem","IPSec End System",NID_ipsecEndSystem,8,
- &(lvalues[2153]),0},
-{"ipsecTunnel","IPSec Tunnel",NID_ipsecTunnel,8,&(lvalues[2161]),0},
-{"ipsecUser","IPSec User",NID_ipsecUser,8,&(lvalues[2169]),0},
{"DVCS","dvcs",NID_dvcs,8,&(lvalues[2177]),0},
{"id-it-caProtEncCert","id-it-caProtEncCert",NID_id_it_caProtEncCert,
8,&(lvalues[2185]),0},
@@ -2897,9 +2894,6 @@ static const unsigned int sn_objs[NUM_SN]={
647, /* "international-organizations" */
869, /* "internationaliSDNNumber" */
142, /* "invalidityDate" */
-294, /* "ipsecEndSystem" */
-295, /* "ipsecTunnel" */
-296, /* "ipsecUser" */
86, /* "issuerAltName" */
770, /* "issuingDistributionPoint" */
492, /* "janetMailbox" */
@@ -4629,7 +4623,4 @@ static const unsigned int obj_objs[NUM_OBJ]={
130, /* OBJ_client_auth 1 3 6 1 5 5 7 3 2 */
131, /* OBJ_code_sign 1 3 6 1 5 5 7 3 3 */
132, /* OBJ_email_protect 1 3 6 1 5 5 7 3 4 */
-294, /* OBJ_ipsecEndSystem 1 3 6 1 5 5 7 3 5 */
-295, /* OBJ_ipsecTunnel 1 3 6 1 5 5 7 3 6 */
-296, /* OBJ_ipsecUser 1 3 6 1 5 5 7 3 7 */
133, /* OBJ_time_stamp 1 3 6 1 5 5 7 3 8 */
diff --git a/crypto/objects/obj_mac.h b/crypto/objects/obj_mac.h
index 27304e1..decf0cc 100644
--- a/crypto/objects/obj_mac.h
+++ b/crypto/objects/obj_mac.h
@@ -1500,21 +1500,6 @@
#define NID_email_protect 132
#define OBJ_email_protect OBJ_id_kp,4L
-#define SN_ipsecEndSystem "ipsecEndSystem"
-#define LN_ipsecEndSystem "IPSec End System"
-#define NID_ipsecEndSystem 294
-#define OBJ_ipsecEndSystem OBJ_id_kp,5L
-
-#define SN_ipsecTunnel "ipsecTunnel"
-#define LN_ipsecTunnel "IPSec Tunnel"
-#define NID_ipsecTunnel 295
-#define OBJ_ipsecTunnel OBJ_id_kp,6L
-
-#define SN_ipsecUser "ipsecUser"
-#define LN_ipsecUser "IPSec User"
-#define NID_ipsecUser 296
-#define OBJ_ipsecUser OBJ_id_kp,7L
-
#define SN_time_stamp "timeStamping"
#define LN_time_stamp "Time Stamping"
#define NID_time_stamp 133
diff --git a/crypto/objects/obj_mac.num b/crypto/objects/obj_mac.num
index 8c50aac..4bc3dfb 100644
--- a/crypto/objects/obj_mac.num
+++ b/crypto/objects/obj_mac.num
@@ -291,9 +291,6 @@ sbgp_ipAddrBlock 290
sbgp_autonomousSysNum 291
sbgp_routerIdentifier 292
textNotice 293
-ipsecEndSystem 294
-ipsecTunnel 295
-ipsecUser 296
dvcs 297
id_it_caProtEncCert 298
id_it_signKeyPairTypes 299
\ No newline at end of file
diff --git a/crypto/objects/objects.txt b/crypto/objects/objects.txt
index 52ac0a6..f477aa5 100644
--- a/crypto/objects/objects.txt
+++ b/crypto/objects/objects.txt
@@ -481,8 +481,5 @@ id-kp 2 : clientAuth : TLS Web Client Authentication
id-kp 3 : codeSigning : Code Signing
!Cname email-protect
id-kp 4 : emailProtection : E-mail Protection
-id-kp 5 : ipsecEndSystem : IPSec End System
-id-kp 6 : ipsecTunnel : IPSec Tunnel
-id-kp 7 : ipsecUser : IPSec User
!Cname time-stamp
id-kp 8 : timeStamping : Time Stamping
