Subject: [pkix] CORRECTED: Request for allocation of extended key purpose identifiers

From: Suresh Krishnan <[email-masked]>
Date: Wed, 10 Feb 2010 11:24:09 -0500

Hi Folks,
    We are working on draft-ietf-csi-send-cert-01 that is a working group
draft of the csi working group. This profile is based on the sidr 
resource certificate profile that allows the use of EKU values as 
described in Section 3.9.5. of

http://tools.ietf.org/html/draft-ietf-sidr-res-certs-17

We would like to request three new OIDs from the extended key purpose 
identifiers registry at
http://www.imc.org/ietf-pkix/pkix-oid.asn for defining EKU values for
SEND certificates.

id-kp-sendRouter OBJECT IDENTIFIER ::= { id-kp X }

id-kp-sendProxy OBJECT IDENTIFIER ::= { id-kp Y }

id-kp-sendOwner OBJECT IDENTIFIER ::= { id-kp Z }

Let us know if we need to provide any more details.

Thanks
Suresh

(Corrected to request three OIDs instead of one. We earlier assumed we 
could create sub-OIDs under the allocated OID)

---

From: Stephen Kent <[email-masked]>
Date: Wed, 10 Feb 2010 11:46:45 -0500

At 11:24 AM -0500 2/10/10, Suresh Krishnan wrote:
>We would like to request three new OIDs from the extended key 
>purpose identifiers registry at
>(Corrected to request three OIDs instead of one. We earlier assumed 
>we could create sub-OIDs under the allocated OID)

Suresh,

Section 3.9.5 of the SIDR document does not provide any detail about 
how these EKUs will be used.  Is there a SeND I-D that you can cite, 
and for which you can  provide section-level references that explains 
how these EKUs will be used?

Steve

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 10 Feb 2010 12:53:29 -0500

Hi Steve,

> how these EKUs will be used?

The usage of these values is described in section 5.2. of

http://tools.ietf.org/html/draft-ietf-csi-send-cert-01

I have reproduced the appropriate text here

    The inclusion of the router authorization value indicates that the
    certificate has been issued for allowing the router to advertise
    prefix(es) that are mentioned using the X.509 extensions for IP
    addresses and AS identifiers [RFC3779]

    The inclusion of the proxy authorization value indicates that the
    certificate has been issued for allowing the proxy to perform
    proxying of neighbor discovery messages for the prefix(es) that are
    mentioned using the X.509 extensions for IP addresses and AS
    identifiers [RFC3779]

    The inclusion of the owner authorization value indicates that the
    certificate has been issued for allowing the node to use the
    address(es) or prefix(es) that are mentioned using the X.509
    extensions for IP addresses and AS identifiers [RFC3779]

Thanks
Suresh