RE: Absent keyUsage in certificates

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"David Cross" <dcross@xxxxxxxxxxxxx> writes:

>But many companies don't want to anticipate the purpose when they issue a 5
>year smartcard, etc.

Doesn't that work the other way as well though?  What if I issue a cert with
no keyUsage (i.e. all usage is OK) that's intended for throwaway use (signing
in to jokeoftheday.com, so I don't protect it much and may even hand it out to
friends) and six month later someone defines a new keyUsage bit
confessingToAssassinateThePresident?  You're assuming that allow-all for any
new usages will be a good thing, but it could quite well be that deny-all is a
better policy.

Peter.