Subject: Key Usage - Intended Usage

From: "Mitchell Arnone" <[email-masked]>
Date: Wed, 06 Sep 2000 13:31:29 -0400

It is my understanding that certificates issued for use with Privacy
Enhanced Mail (PEM) and/or S/MIME should include the Key Usage extension
with the "keyEncipherment" bit set.  However, I have been challenged by
management to find proof that this is so.  I have looked in rfc 1421,
1422, 1521, PKCS7 and nowhere is there documented a requirement or even
a recommendation stating that certificates used for PEM and/or S/MIME
applications should require this extension and bit.  While it may appear
obvious, after reading the standards identifying key encipherment as
part of the process, I still need something more specific.  Can anyone
shed some light for me?

So much of PKI seems to be left up to interpretation with little or no
supporting evidence that can be used by an organization to justify a
particular strategy as being standards based.  Many have a real
love/hate relationship with PKI  and I believe that it is because,
though this is great technology, without well defined (less ambiguity)
and openly supported (and enforced) standards, it is hard to build and
sell.

Another good example of our frustration is non-repudiation.  This bit
has spawned many intense discussions pertaining to its intended use as
well as proper configuration/implementation (used with the digital
signature bit enabled as well or not).  Some argue that non-repudiation
can be established without this bit set so why set it at all.  Some have
said that this bit should trigger some action on the part of the
application to verify that non-repudiation will result if the user
intends to "proceed to the next step" (digital signature) in a
particular process and still others think that it is intended to be used
by organizations as a means to restrict a particular certificate to a
specific use (keep some "high value" signature certs (key pair) from
being used for day-to-day authentication or signing personal email and
etc.).  Any opinions on this?

Mitch Arnone
***************
PKI Engineer
[email-masked]

---

From: Hal Lockhart <[email-masked]>
Date: Wed, 6 Sep 2000 13:41:23 -0400

You will be happy to hear that this mailing list has had all of the same
arguments, with little resolution. Check the archives back 12-24 months.

Hal

=======================================================
Harold W. Lockhart            Entegrity Solutions
2 Mount Royal Avenue          Marlborough, MA 01752 USA
V: 1-508-624-9600 x 260       [email-masked]
F: 1-508-229-0338             www.entegrity.com
=======================================================

> -----Original Message-----
> From: Mitchell Arnone [mailto:[email-masked]]
> Sent: Wednesday, September 06, 2000 1:31 PM
> To: IETF-PKIX LIST
> Subject: Key Usage - Intended Usage
> 
>