encipherOnly and decipherOnly Key Usages

["Simonetti David" <simonettid@xxxxxxx>]

I have a question on usage of the encipherOnly and decipherOnly key usages. 
 Assume I use the pulic key agreement key to protect a token.  The token in 
turn houses the message key that was used to encrypt the message.  Taking 
X.509 literally, setting encipherOnly means that the public key agreement 
key shall only be used to encrypt the token.

In my example, is it possible (is it correct) to interpret the definition of 
encipherOnly to mean that I may only use the public key of that certificate 
as part of the process to encrypt a message, eventhough I am not directly 
using the public key agreement key to do so?  (And ditto for decipherOnly.)

Dave Simonetti
Booz-Allen & Hamilton Inc.