Re: interpretation of extended key usage

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"Heyden, Klaus" <Klaus.Heyden@xxxxxxxxxxxxxxxxx> writes:

>(1) the extended key usage is only usable for the use of the public key itself
>and his direct usage i.e. signing of certificates etc. (view RFC 2469 4.2.1.13
>first sentence). So a root certificate dont need an extended key usage, because
>the public key will only be needed for path validation and signing of
>certificates and CRLs.
>
>(2) the public key is also needed for path validation, so an extended key
>usage can be used to restrict the use of sub and end entity certificates.
>
>I have looked a bit around and found some CA certificates with extended key
>usages, so its a bit confusing. Both way's are imagineable.

Both are used (see e.g. the X.509 style guide for comments).  If you need to
use one or the other, just find the appropriate standard which specifies the
one you want.  Alternatively, if you have to comply with a certain standard,
make sure that the software you're using does actually apply the same
interpretation as the standard.

Peter.