Re: draft-ietf-pkix-rfc3770bis-01: key usage extension

[Peter Sylvester <Peter.Sylvester@xxxxxxxxxx>]

> >
> >take a cert with all bit on. This is equivalent to having no keyUsage at all
> >as far as I remember. in this case the keyCertSign bit and the cRLSign are 
> >set,
> >and the above 'MUST NOT' prohibits use of this cert. is this what you intend?
> >I don't think so.
> >
> >Isn't the right wording: no known EAP usage requires keyCertSign or cRLSign?
> 
> How about: ... however, EAP methods MUST NOT require the keyCertSign bit or
> the cRLSign to be set in end entity certificates.


- the initial text had no keyUsage restriction.

- the current has a restriction that technically doesn't make any
  sense and is incompatible with the standard.

- Above you propose something that is a restriction for EAP methods
  which was not in 3770. Can you justify this change, please.


Peter
PS: Would it be possible to instruct your mail user agent not to send
me two copies just because I am twice in the To list, or else. Thanks