Subject: keyCertSign and Path Validation

From: "Andreas Sterbenz" <[email-masked]>
Date: Mon, 14 May 2001 13:55:14 +0200

All,

new-part1-06 states in section 6.1.4 (Preparation for Certificate i+1) that

  (n) If a key usage extension is present and marked critical,
  verify that the keyCertSign bit is set.

A certificate that fails this check is rejected. However, this means that a
certificate with a non-critical key usage extension is always accepted, even
if the keyCertSign bit is not set.

I am wondering if that behavior is intentional as it seems to conflict with
the text describing the key usage and basic constraints extension.

 Andreas Sterbenz              mailto:[email-masked]

---

From: "Housley, Russ" <[email-masked]>
Date: Mon, 14 May 2001 16:48:51 -0400

It is intentional.  I do not recall all of the reasons.  One reason was to 
permit support for version 1 certificates. A version 1 certificate cannot 
be part of a certification path if we handle it differently.

Russ

---

From: "Andreas Sterbenz" <[email-masked]>
Date: Wed, 16 May 2001 12:24:31 +0200

The point I was making is that the key usage extension, if present, is
handled differently depending on whether or not it is critical. This may be
for a reason, but it seems neither intuitive to me nor explained in the rest
of the document.

The reason I came across this is the X.509 conformance test suite by NIST,
Cygnacom, and others posted to the list by Tim Polk some time ago. It
requires that CA certificates with a non-critical key usage extension and
the keyCertSign bit cleared are rejected (IC.05.02). This is in obvious
contradiction to the PKIX validation algorithm.

This may be either due to an oversight in either of the two, or due to an
incompatible interpretation of X.509. I believe the issue should be
addressed in either case. The text below from X.509 4th ed. draft 8 seems to
confirm the NIST position.

===
If the extension if flagged non-critical, then it indicates the intended
purpose or purposes of the key, and may be used in finding the correct
key/certificate of an entity that has multiple keys/certificates. If this
extension is present, and the certificate-using system recognizes and
processes the keyUsage extension type, then the certificate-using system
shall ensure that the certificate shall be used only for a purpose for which
the corresponding key usage bit is set to one. A bit set to zero indicates
that the key is not intended for that purpose. If all bits are zero, it
indicates the key is intended for some purpose other than those listed.
===