Stephen Farrell <stephen.farrell@xxxxxxxxx> writes:
There's a bit (NR/CC) whose meaning has been the subject of loads and loads
of rambling discussion for ages and ages, and you want to define DS=
NOT(NR/CC)? Sounds like a great way to spread the NR fuzziness around, i.e. a
bad idea.
Oh was that what all that was about? I'd gone off to reorganise my sock
drawer and sort my packets of alphabet soup after the first 800 or so messages
went by, so I probably missed some bits.
The motivation for the comment was that we've just gone through the
keyEncipherment vs. dataEncipherment debate where no-one's quite sure which
bits to set for what occasion, and now in an attempt to fix the equally-
problematic DS vs. NR we're creating a similar problem: what do you do in
situations where neither the DS nor CC/NR bits fit? I don't really care how
the bits are defined, as long as it doesn't end up creating un-uses that can't
be clearly signified with either DS or CC/NR. Without this, we'll get another
situation like the dataEncipherment one where something doesn't fall easily
into either choice, so users and CAs claim that their choice of DS or CC
applies, whatever happens to coincide with what their software does.
The digitalSignature bit is asserted when the subject public key
is used for verifying digital signatures that are used
with an entity authentication service, a data origin authentication
service or/and an integrity service. Note that a certificate
with only the digitalSignature bit set MUST NOT be used for
verifying certificate or CRL signatures.
Sounds good to me.
Peter.