Subject: Re: draft-ietf-pkix-rfc3770bis-01: key usage extension

From: Peter Sylvester <[email-masked]>
Date: Fri, 15 Apr 2005 10:10:45 +0200 (MEST)

> >
> >take a cert with all bit on. This is equivalent to having no keyUsage at all
> >as far as I remember. in this case the keyCertSign bit and the cRLSign are 
> >set,
> >and the above 'MUST NOT' prohibits use of this cert. is this what you intend?
> >I don't think so.
> >
> >Isn't the right wording: no known EAP usage requires keyCertSign or cRLSign?
> 
> How about: ... however, EAP methods MUST NOT require the keyCertSign bit or
> the cRLSign to be set in end entity certificates.

- the initial text had no keyUsage restriction.

- the current has a restriction that technically doesn't make any
  sense and is incompatible with the standard.

- Above you propose something that is a restriction for EAP methods
  which was not in 3770. Can you justify this change, please.

Peter
PS: Would it be possible to instruct your mail user agent not to send
me two copies just because I am twice in the To list, or else. Thanks

---

From: Russ Housley <[email-masked]>
Date: Fri, 15 Apr 2005 10:38:24 -0400

Peter:

You are the one that complained that there was not discussion of the key 
usage extension.  I am happy to delete the whole paragraph ... you are the 
one who asked for the topic to be covered.

How about this:

    If a certificate contains a key usage extension, the KeyUsage bits
    that are needed depends on the EAP method that is employed.

Russ