Subject: Re: Re[2]: TSA certificate content

From: Peter Sylvester <[email-masked]>
Date: Tue, 25 Nov 2003 12:00:44 +0100 (MET)

> 
> As the specification actually, I also think that absence of keyUsage is
> permissible.
> 
> But I wonder why a certificate do not include keyUsage extension, though
> the certificate declares extendedKeyUsage.
> What kind of situation does it apply in?
> 
> I have no idea about the reason to use only extendedKeyUsage extension
> for a certificate without using keyUsage extension...
> 

In RFC 3280 page 41 about extendedkeyUsage: 

   If the extension is present, then the certificate MUST only be used
   for one of the purposes indicated. 

I understand this as "no need to set anything at all in keyUsage."

---

From: "Ing. Raffaello Galli" <[email-masked]>
Date: Tue, 25 Nov 2003 14:27:45 +0100

I->> As the specification actually, I also think that absence of keyUsage is
->> permissible.
->>
->> But I wonder why a certificate do not include keyUsage extension, though
->> the certificate declares extendedKeyUsage.
->> What kind of situation does it apply in?
->>
->> I have no idea about the reason to use only extendedKeyUsage extension
->> for a certificate without using keyUsage extension...
->>
->
->In RFC 3280 page 41 about extendedkeyUsage:
->
->   If the extension is present, then the certificate MUST only be used
->   for one of the purposes indicated.
->
->I understand this as "no need to set anything at all in keyUsage."

No I do not agree,  as I've explained in my previos mail according to the
RFC3161
the extendedkeyUsage (id-kp-timeStamping) MUST be the only one.
This doesn't  mean that the Key Usage should not be set.
In fact in RFC 3280 (page 42) regarding id-kp-timeStamping  says:
"Key usage bits may be consistent: digitalSignature and/or nonRepudiation"

Cheer
Raffaello