Re: key usage - key encipherment or data encipherment

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"Wen-Cheng Wang" <wcwang@xxxxxxxxxx> writes:

>It is better to clarify that it is legitimate to assert both the
>keyEncipherment bit and the dataEncipherment bit in one certificate. In that
>case, it means that the key (e.g., RSA key) may be used for enciphering
>intermediate cryptographic keys or directly enciphering raw user data (e.g.,
>user password).

Saying you can use both bits won't help, it still leaves it ambiguous to users
as to what dataEncipherment should be used for.  One interpretation I've heard
of is keyEncipherment = exchange of session keys (SSL), dataEncipherment =
data encryption (S/MIME).

Peter.