Subject: Question from a new comer about KeyUsage

From: "Prashant Kumar" <[email-masked]>
Date: Wed, 21 Mar 2001 11:26:02 -0500

In one of the Microsoft Certificate the Key usage bits are 
set as 0x05 A0(0000 0101 1010 0000). If we open the 
certificate using MS it claims that

1. Digital Signature, Key Encipherment[A0] bits are set.

However if you go according to the RFC 2459 it actually has
Digital Signature, nonRepudiation, and dataEncipherment set
....(Bits 0, 1 and 3) bit 8 is the right most bit... 

KeyUsage ::= BIT STRING {
digitalSignature (0),
nonRepudiation (1),
keyEncipherment (2),
dataEncipherment (3),
keyAgreement (4),
keyCertSign (5), 
cRLSign (6),
encipherOnly (7),
decipherOnly (8) } 

Any Comments ?

Regards,
Prashant.

---

From: Hans Schupp <[email-masked]>
Date: Thu, 22 Mar 2001 01:31:37 +0100

> ....(Bits 0, 1 and 3) bit 8 is the right most bit...

You left out the fact, that KeyUsage is encoded as a BIT STRING, which
has a special meaning for the first byte. The 0x05 only says: the 5 last
bits of the following byte are unused, i.e. from the byte 10100000 only
the part 101xxxxx is meaningful.
Take this and you get exactly the bits "digitalSignature" and
"keyEncipherment". MS is not always wrong ;-)

regards, Hans
--
Hans Schupp, SECUDE GmbH, +49-6151-82897-0
_________________________________________________
CeBIT Hannover 22.-28.03.2001, hall 2 / booth B18