Subject: RFC 3280 : key usage extension

From: Takashi ITO <[email-masked]>
Date: Wed, 04 Dec 2002 15:09:26 +0900

Hello,

I have a question about key usage extension in RFC 3280.

In clause 4.2.1.3, describing key usage extension, it says:

    This extension MUST appear in certificates that contain public keys
    that are used to validate digital signatures on other public key
    certificates or CRLs.

It means that CA certificates which conform to RFC 3280 MUST include
this extension.

However, Certification Path Validation described in clause 6.1.4 says:

    (n)  If a key usage extension is present, verify that the
    keyCertSign bit is set.

This means that CA certificates(v3) without key usage extension may pass
above check.

I think it would be better to replace as follows:

    (n)  If the certificate is version 3, verify that a key usage
    extension is present, and that the keyCertSign bit is set.

Is that right?

Thanks,

Takashi ITO <[email-masked]>
Mitsubishi Electric Corporation

---

From: Russ Housley <[email-masked]>
Date: Wed, 04 Dec 2002 10:19:18 -0500

You are correct that CA certificates that conform to the profile will 
contain the key usage extension.  However, in the validation algorithm we 
made an attempt to accommodate "legacy" certificates.  This is one of the 
cases we support.

Russ

---

From: Takashi ITO <[email-masked]>
Date: Thu, 05 Dec 2002 11:26:59 +0900

Russ,

I'm sorry I forgot that the CA certificate which conforms to RFC 2459
may not contain this extension.

Thanks,

From: "Russ Housley" <[email-masked]>

---

From: Geoff Elgey <[email-masked]>
Date: Thu, 05 Dec 2002 14:27:37 +1000

G'day,

> contain the key usage extension.  However, in the validation algorithm 
> we made an attempt to accommodate "legacy" certificates.  This is one of 
> the cases we support.

Is there a similar accomodation for key usage extension and public keys 
that are used for encrypting?

I'm thinking of SCEP, where a session key must be encrypted with the 
CA's public key, to envelope the enroller's certification request.

RFC 3280, section 4.2.1.3 states that "the keyEncipherment bit is 
asserted when the subject public key is used for key transport. For 
example, when an RSA key is to be used for key management, then this bit 
is set."

I'm assuming that encrypting a session key is consistent with key 
transport as defined in section 4.2.1.3.

But all SCEP servers I have come examined return a CA certificate with a 
key usage that indicates signing only, not encrypting.

So am I wrong to assume that the keyEncipherment bit should be set in 
the keyUsage extension for CA cert returned from a SCEP server? Or is 
the keyEncipherment bit typically ignored when enveloping?

Cheers,
Geoff

---

From: Russ Housley <[email-masked]>
Date: Thu, 05 Dec 2002 13:29:13 -0500

Geoff:

In this protocol environment, the CA certificate is an end entity.  The 
protocol wants that end entity to perform signature and key transport 
operations.  I would expect both bits to be set.

Russ

At 02:27 PM 12/5/2002 +1000, Geoff Elgey wrote:

>I'm thinking of SCEP, where a session key must be encrypted with the CA's 
>public key, to envelope the enroller's certification request.
>
>RFC 3280, section 4.2.1.3 states that "the keyEncipherment bit is asserted 
>when the subject public key is used for key transport. For example, when 
>an RSA key is to be used for key management, then this bit is set."
>
>So am I wrong to assume that the keyEncipherment bit should be set in the 
>keyUsage extension for CA cert returned from a SCEP server? Or is the 
>keyEncipherment bit typically ignored when enveloping?
>
>Cheers,
>Geoff
>
>
>