Questions tagged [rfc]

How to interpret security aspects of RFC (Request For Comments) documents.

Filter by
Sorted by
Tagged with
0
votes
1answer
78 views

Which RFCs should I read for web pentesting? [closed]

I'm new in web pentesting and I have read a lot of books. But I think I should read some RFC to have a better knowledge about web applications. There is a lot of RFC and I'm a bit lost on which one ...
2
votes
0answers
36 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
0
votes
0answers
13 views

Clarification needed on OAuth 2.0 Framework RFC content

In the introduction part of OAuth 2.0 RFC document, the 4th bullet mentions as follows: Resource owners cannot revoke access to an individual third party without revoking access to all ...
1
vote
1answer
981 views

OAuth2 for mobile apps with confidential backend client (Is PKCE required?)

I'm wondering why neither rfc6749 nor rfc8252 seem to consider the case where the mobile app does not make protected resource requests (and is therefore not a client) but instead relies on a backend ...
1
vote
0answers
43 views

Use of ESSCertIDv2 in a RFC 3161 Timestamp

A qualified trust service provider under eIDAS uses ESSCertIDv2 for their time stamp tokens, but ESSCertIDv2 was not present in the RFC 3161 specification, it was added later in RFC 5816. RFC 3161 in ...
3
votes
1answer
581 views

Why does curl/NSS encryption library not allow a CA with the extended key usage by SEC_ERROR_INADEQUATE_CERT_TYPE?

Problem curl rejects the CA certificate below with 60) Certificate type not approved for application for SEC_ERROR_INADEQUATE_CERT_TYPE. I would like to understand the reason. ...
1
vote
0answers
35 views

RFC6960 requested ocsp service definition

In RFC6960 (https://tools.ietf.org/html/rfc6960) is written the request data contains the requested service and the OCSP responder checks, if the requested service is provided. But when I had a look ...
2
votes
2answers
110 views

TLS Extentions: Omitting TLS Handshake Messages

I've been reading though various RFCs and couldn't find a definite answer to my question: can a negotiated TLS extension skip some of the TLS Handshake messages and still be compliant with the TLS ...
2
votes
1answer
410 views

Designing CP and CPS for multiple hierarchical CAs

I am thinking about how to design and structure CP and CPS for multiple CAs build in a hierarchical manner and compliant to RFC 3647. The structure of CAs in build from one Root CA to multiple ...
7
votes
2answers
233 views

Why did RFC 4158 (Path Building) restrict Trust Anchors to self-signed certificates?

I'm having trouble using Wget to download a file over HTTPS from ftp.gnu.org using the Let's Encrypt X3 root. The Let's Encrypt X3 is cross-certified, which means it has an issuer and its not self-...