[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: key usage - key encipherment or data encipherment

Peter Gutmann wrote: 
Andrew Sciberras <andrewsciberras@xxxxxxxxx> writes:

  
    The keyEncipherment bit is asserted when the subject public key is
     used for key transport.  For example, when an RSA key is to be
     used for key management, then this bit shall asserted.

     The dataEncipherment bit is asserted when the subject public key
     is used for enciphering user data, other than cryptographic keys.
    

Quoting that won't help (I've seen this sort of thing before) because as far
as the user is concerned what's being encrypted is data, so the valid bit to
use is dataEncipherment (quite logical to them).  What might help is to make
this more explicit in the text:

  The dataEncipherment bit is asserted when the subject public key is used for
  directly enciphering raw user data without the use of an intermediate
  symmetric cipher.  This bit MUST NOT be set when the intention is to
  encipher intermediate cryptographic keys rather than raw user data.
Yeah, I see your point Peter.
Simon seems to know what he's talking about and made the point that the key is actually encrypting an AES key, he then wanted a standards based opinion.
I think RFC 2459 clearly states what each of the key usage bits are to be used for.

I don't think that the user's interpretation of what's being encrypted is significant at all. Its more about the developers who are writing decision making code understanding the various usages. At that point the developer should be very aware of how the key associated with the certificate is being used and therefore 2459's description should suffice.


Peter.
Andrew Sciberras.