Subject: Re: correction, was Re: proposed key usage text

From: Ed Gerck <[email-masked]>
Date: Wed, 17 Nov 1999 12:32:07 -0800

Aram Perez wrote:

> Hi Ed,
>
> >> Then, we would need to consider all 64K combinations of  eight bits
> >> and provide rules for their usage or exclusion -- after all, we can't just
> >> stop at prohibiting (DS=1, NR=1) and would need to move on as
> >> Aram has tried to motivate (provoke?):
> >
> > Obvious slip, but just so that I don't overstate my case ;-)
> >
> > " we would need to consider all 256 combinations of  eight bits"
>
> Sorry, wrong again: there are NINE bits, numbered 0 - 8, so it would be 512
> combinations.
>
> ;-)
>
> Aram

Yes, because there is no need to consider bits 7 and 8 as mutually
exclusive even though they are respectively called decipherOnly and
encipherOnly.

And, we can add more bits with extendedKeyUsage. We may then even
end up with 64K combinations ;-)

Which just makes it harder to justify lisiting them all and enforcing
their meaning as code words ... even for 512 combinations.

Cheers,

Ed Gerck

---

From: [email-masked]
Date: Wed, 17 Nov 1999 16:15:04 -0500

There are actually 9 bits, but the correct number of combinations is
256.  Even in the current standard, the last two bits are mutually
exclusive and dependent on keyAgreement so the combinations are (2**6 for
the signature and encipherment bits * (keyAgreement off, keyAgreement
without encipher/decipher, keyAgreement with encipher, keyAgreement with
decipher)).  Given the profiles of keyUsage by key type in section 7.3, you
could argue that the number of combinations is only 68 (4 for
keyAgreement-type keys such as Diffie-Hellman, 64 for RSA, with DSA's
settings a subset of RSA's).  If further restrictions are made along this
line, the number of legal combinations could turn out not to be very large.

          Tom Gindin

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 18 Nov 1999 10:34:32 (NZDT)

>There are actually 9 bits, but the correct number of combinations is 256.
>Even in the current standard, the last two bits are mutually exclusive and
>dependent on keyAgreement so the combinations are (2**6 for the signature and
>encipherment bits * (keyAgreement off, keyAgreement without encipher/decipher,
>keyAgreement with encipher, keyAgreement with decipher)).  Given the profiles
>of keyUsage by key type in section 7.3, you could argue that the number of
>combinations is only 68 (4 for keyAgreement-type keys such as Diffie-Hellman,
>64 for RSA, with DSA's settings a subset of RSA's).  If further restrictions
>are made along this line, the number of legal combinations could turn out not
>to be very large.

It could be larger than you'd think, because DLP keys can be used in a wide
variety of ways - a DSA/X9.42 public key could be used for DSA, DH, and 
Elgamal, covering every combination of key bits (admittedly it's identified
by dhPublicNumber, but it's also used as an mqvPublicNumber and could just as 
easily be used as a dsaPublicNumber or elgamalPublicNumber).

Peter.