Re: Absent keyUsage in certificates

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Sam Roberts <sroberts@xxxxxxxxxxxx> writes:

>I don't see the problem you would like to fix. Are you saying that its easier
>for a CA to mistakenly not include a KeyUsage than it is to mistakenly
>include a KeyUsage with all bits set?

While I haven't done a comprehensive survey (I don't think that's possible,
given the number of random CAs floating around out there), I've come across a
number of cases where the CA intended to issue (say) a signature-only cert,
forgot a keyUsage, and was rather surprised when told that their cert could be
used for anything at all.  Making keyUsage explicit in all cases just seems
like a nice way of tying up various loose ends.

Peter.