IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [rfc]

How to interpret security aspects of RFC (Request For Comments) documents.

18 questions
7
votes
2 answers

Why did RFC 4158 (Path Building) restrict Trust Anchors to self-signed certificates?

I'm having trouble using Wget to download a file over HTTPS from ftp.gnu.org using the Let's Encrypt X3 root. The Let's Encrypt X3 is cross-certified, which means it has an issuer and its not self-signed. When using Let's Encrypt X3, Wget is failing…
user29925
4
votes
1 answer

PBKDF2 doesn't seem to have a standardised implementation?

I recently read about the bug in Django with regards to PBKDF2 causing Denial of Service with large passwords: https://www.djangoproject.com/weblog/2013/sep/15/security/ This is because PBKDF2 "mixes" in the input password with each iteration,…
Ryan Sheasby
  • 43
  • 4
3
votes
1 answer

Name Constraints, empty sets in permitted subtree (RFC 3280 vs RFC 5280)

I'm trying to understand the effect of empty sets in permittedSubtrees in both, RFC 5280 and RFC 3280. There is something that doesn't compile in my head. Scenario: We have a CA certificate with the following Name Constraints setup: Permitted …
Crypt32
  • 5,750
  • 12
  • 24
3
votes
1 answer

Why does curl/NSS encryption library not allow a CA with the extended key usage by SEC_ERROR_INADEQUATE_CERT_TYPE?

Problem curl rejects the CA certificate below with 60) Certificate type not approved for application for SEC_ERROR_INADEQUATE_CERT_TYPE. I would like to understand the reason. SEC_ERROR_INADEQUATE_CERT_TYPE A certificate has an extended key usage…
mon
  • 275
  • 3
  • 9
2
votes
1 answer

Why is PKCE "RECOMMENDED" for authorization codes with confidential clients?

Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows: Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. Public clients MUST use PKCE [RFC7636] to this end. …
Matthew Rodatus
  • 441
  • 4
  • 11
2
votes
0 answers

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP enabled, and this works. I have tested the LDAP…
Asser Fahrenholz
  • 21
  • 1
2
votes
2 answers

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend server (confidential client) that does. *Note…
el_tigro
  • 694
  • 8
  • 14
2
votes
2 answers

TLS Extentions: Omitting TLS Handshake Messages

I've been reading though various RFCs and couldn't find a definite answer to my question: can a negotiated TLS extension skip some of the TLS Handshake messages and still be compliant with the TLS specification? My goal is to develop a new version…
Illya Gerasymchuk
  • 141
  • 5
2
votes
1 answer

Designing CP and CPS for multiple hierarchical CAs

I am thinking about how to design and structure CP and CPS for multiple CAs build in a hierarchical manner and compliant to RFC 3647. The structure of CAs in build from one Root CA to multiple subordinate CAs each serving different PKI service and…
user1563721
  • 1,099
  • 11
  • 22
1
vote
1 answer

How to convert 64byte openssh-key-v1 to the resulting 32byte ed25519 private key

I wrote an openssh-key-v1 Protocol reader and extracted all fields according to the format definition: "openssh-key-v1"0x00 # NULL-terminated "Auth Magic" string 32-bit length, "none" # ciphername length and string 32-bit length, "none" #…
Richard Burkhardt
  • 135
  • 6
1
vote
1 answer

Use of ESSCertIDv2 in a RFC 3161 Timestamp

A qualified trust service provider under eIDAS uses ESSCertIDv2 for their time stamp tokens, but ESSCertIDv2 was not present in the RFC 3161 specification, it was added later in RFC 5816. RFC 3161 in 2.4.2 requires ESSCertID: The certificate…
Victor
  • 373
  • 1
  • 10
1
vote
0 answers

RFC6960 requested ocsp service definition

In RFC6960 (https://www.rfc-editor.org/rfc/rfc6960) is written the request data contains the requested service and the OCSP responder checks, if the requested service is provided. But when I had a look on OCSP's ASN.1 specification…
micha
  • 11
  • 1
0
votes
2 answers

Is a consent screen in an OAuth 2.0 implementation optional

I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749 The only mention of consent is in this bit: The authorization server MUST implement CSRF protection for its authorization endpoint and ensure that a malicious client…
Ash
  • 111
  • 6
0
votes
0 answers

Why does RFC5816 not change the version number defined in RFC3161

So, RFC5816 https://www.ietf.org/rfc/rfc5816.txt changes the specification of RFC3161 https://www.ietf.org/rfc/rfc3161.txt RFC3161 specifies the 'version' field in TSTInfo to be set to 1 Why does RFC5816 not change the value of this field? wouldn't…
matthias_buehlmann
  • 565
  • 4
  • 12
0
votes
1 answer

What header & footer to use when storing RFC3161 token in PEM format

The RFC3161 (https://www.ietf.org/rfc/rfc3161.txt) specification states 3. Transports There is no mandatory transport mechanism for TSA messages in this document. The mechanisms described below are optional; additional optional mechanisms…
matthias_buehlmann
  • 565
  • 4
  • 12
1
2