Subject: [pkix] [Technical Errata Reported] RFC5480 (6670)

From: RFC Errata System <[email-masked]>
Date: Tue, 31 Aug 2021 14:37:31 -0700 (PDT)

The following errata report has been submitted for RFC5480,
"Elliptic Curve Cryptography Subject Public Key Information".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6670

--------------------------------------
Type: Technical
Reported by: Corey Bonnell <[email-masked]>

Section: 3

Original Text
-------------
If the keyUsage extension is present in a certificate that indicates
   id-ecDH or id-ecMQV in SubjectPublicKeyInfo, then the following
   values MUST NOT be present:

     digitalSignature;
     nonRepudiation;
     keyTransport;
     keyCertSign; and
     cRLSign.

Corrected Text
--------------
If the keyUsage extension is present in a certificate that indicates
   id-ecDH or id-ecMQV in SubjectPublicKeyInfo, then the following
   values MUST NOT be present:

     digitalSignature;
     nonRepudiation;
     keyEncipherment;
     keyCertSign; and
     cRLSign.

Notes
-----
"keyTransport" KU bit name does not exist; I believe "keyEncipherment" is intended here instead.

While RFC 8813 makes it clear that "keyEncipherment" and "dataEncipherment" are prohibited, I'm marking this erratum as "Technical" due the reference to a non-existent bit name.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC5480 (draft-ietf-pkix-ecc-subpubkeyinfo-11)
--------------------------------------
Title               : Elliptic Curve Cryptography Subject Public Key Information
Publication Date    : March 2009
Author(s)           : S. Turner, D. Brown, K. Yiu, R. Housley, T. Polk
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG