diff --git a/draft-ietf-scitt-architecture.md b/draft-ietf-scitt-architecture.md index 1e668911..c4d9fcf1 100644 --- a/draft-ietf-scitt-architecture.md +++ b/draft-ietf-scitt-architecture.md @@ -491,8 +491,8 @@ Multiple Issuers can make the same Statement about a single Artifact, affirming At least one identifier representing one credential MUST be included in the protected header of the COSE Envelope, as one of `x5t` or `kid`. Additionally, `x5chain` that corresponds to either `x5t` or `kid` identifying the leaf certificate in the included certification path MAY be included in the unprotected header of the COSE Envelope. -- When using x509, Support for `x5t` is mandatory to implement. -- Support for `kid` in the protected header and `x5chain` in the unprotected heaer is optional. +- When using x.509 certificates, support for `x5t` is REQUIRED to implement. +- Support for `kid` in the protected header and `x5chain` in the unprotected header is OPTIONAL to implement. When `x5t` is present, `iss` MUST be a string with a value between 1 and 8192 characters in length that fits the regular expression of a distinguished name.