Subject: Re: Absent keyUsage in certificates

From: [email-masked] (Peter Gutmann)
Date: Fri, 03 Jun 2005 23:08:30 +1200

Sam Roberts <[email-masked]> writes:

>I don't see the problem you would like to fix. Are you saying that its easier
>for a CA to mistakenly not include a KeyUsage than it is to mistakenly
>include a KeyUsage with all bits set?

While I haven't done a comprehensive survey (I don't think that's possible,
given the number of random CAs floating around out there), I've come across a
number of cases where the CA intended to issue (say) a signature-only cert,
forgot a keyUsage, and was rather surprised when told that their cert could be
used for anything at all.  Making keyUsage explicit in all cases just seems
like a nice way of tying up various loose ends.

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Mon, 20 Jun 2005 19:01:40 +0200

Peter Gutmann wrote:
> Making keyUsage explicit in all cases just seems

+1

Ciao, Michael.