Subject: Re: key usage - key encipherment or data encipherment

From: Russ Housley <[email-masked]>
Date: Thu, 12 May 2005 15:21:02 -0400

There has been a whole lot of discussion about these paragraphs.  Since 
some of the discussion has not been CCed to the PKIX mail list, I am 
posting the resulting words.

      The keyEncipherment bit is asserted when the subject public key is
      used for enciphering private or secret keys, i.e., for key transport.
      For example, this bit shall be set when a RSA public key is to be
      used for encrypting a symmetric content-decryption key or an
      asymmetric private key.

     The dataEncipherment bit is asserted when the subject public key
     is used for directly enciphering raw user data without the use of
     an intermediate symmetric cipher. Note that the use of this
     bit is extremely uncommon; almost all applications use
     key transport or key agreement to establish a symmetric key.

I hope we a re close to closure on this one....

Russ

---

From: Arshad Noor <[email-masked]>
Date: Thu, 12 May 2005 20:38:36 -0700

I am afraid, this still does not provide sufficient clarity.

Some questions that I cannot answer, based on reading the text
below (although I know the answers from practice) are:

1) Whose private key am I encrypting with the public key?  Mine?
    Hopefully not, because if this were the only copy of my private
    key, what am I going to use to decrypt the cipher-text with?
    While this may appear as a ridiculous notion, the point is that
    the text does not clarify this question.

2) What if I'm not using the certificate for key transport?  I may
    have issued a certificate to a database that generates symmetric
    keys to encrypt database content, and then stores the encrypted
    symmetric key within the same database with the cipher-text. I'm
    not transporting the symmetric key anywhere, so should I be using
    the keyEncipherment bit or the dataEncirpherment bit?

In my opinion, the confusion arises because the two bits perform
the same function: encipherment (as Simon McMahon pointed out in
an earlier posting), but for different purposes.

There is a certain simplicity to having just one encipherment bit,
letting applications decide what they want to encrypt with the
certificate's public-key and letting them codify it in *their*
protocols - as S/MIME does - or through EKU's.

Arshad Noor
StrongAuth, Inc.

---

From: "Laudon Williams" <[email-masked]>
Date: Thu, 12 May 2005 20:26:54 -0700

Simply an observation, not a disagreement.

Unfortunately, the keyEncipherment bit has grown to be used for both key
encipherment and data encipherment. I see this a lot, especially with
field-level encryption in databases, and encryption of small data files.

I guess what I'm getting at is that I never see certificates with the
dataEncipherment bit set in it in actual use, but I come across lots of
places when data is encrypted with the private key.

With that said, I like the text below.

-Laudon

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Russ Housley
Sent: Thursday, May 12, 2005 12:21 PM
To: [email-masked]
Subject: Re: key usage - key encipherment or data encipherment

Russ

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Fri, 13 May 2005 17:48:30 +0800

I also hesitate to accept the term "key transport", which will
result in over-narrowing down the usage scope of the
keyEncipherment bit. As Arshad pointed out, sometimes
the intention is not to transport the encrypted symmetric key
to anywhere. Besides, it is often that the handshake protocol
is not simply a "key transport" process; it is more often be
a more complex "key exchange" process. For example,
the SSL handshake protocol names it as "key exchange"
instead of "key transport". Would it be valid for a SSL server
cert to be asserted with that keyEncipherment bit?
To avoid the possible dispute on the definition of
similar terms, I would like to suggest to drop the term "key
transport" from the definition of the key usage bit. (However,
I think it is OK to use "key transport" as an example to
explain the the definition of the key usage bit.

I also think it is strange to positively list "private keys" and
"secret keys" as the only two possible types of keys that can
be encrypted by the subject public key? What if someday
another type of keys is invented and need to be encrypted by
the subject public key? Why not simply use the term
"cryptographic keys"? I believe the term  "cryptographic keys"
is general enough to cover any types of keys.

My other concern is that the current definition of the key
usage bit seems to only allow the subject public key be
used for enciphering "keys". However, we must note that
it is more often that modern handshake protocols actually
use the subject public key for enciphering "keying materials"
instead of the "real keys". For example,  the
pre-master-secret in the SSL hadnshake protocol is not
yet a "real key"; it is actually be a "keying material" that
can be used to derive "real shared secret keys" between
the client and the server. Therefore, I suggest that we
should take the possibility of enciphering "keying materials"
instead of the "real keys" into account.

Here I propose to revise the definitions of this two key usage
bits as follows:

      The keyEncipherment bit is asserted when the subject public key is
      used for enciphering cryptographic keys or keying materials.
      For example, this bit shall be set when a RSA public key is to be
      used for key transport that involves encrypting a symmetric
      content-decryption key or an asymmetric private key.
 
     The dataEncipherment bit is asserted when the subject public key
     is used for directly enciphering raw user data, other than cryptographic
     keys or keying materials, without the use of an intermediate symmetric
     cipher. Note that the use of this bit is extremely uncommon; almost all
     applications use key transport or key agreement to establish shared
     cryptographic keys.

Wen-Cheng Wang

---

From: Stephen Kent <[email-masked]>
Date: Fri, 13 May 2005 10:15:07 -0400

>explain the the definition of the key usage bit.

As commonly employed, a client uses an RSA public key associated with 
a server to encrypt and transport key bits that will later be used to 
create encryption and integrity keys for protecting the session. That 
is an example of key transport. If one used the Diffie-Hellman key 
agreement option for SSL, that would be accurately be described as a 
key exchange, but that is rarely the case, in practice.  So I am 
puzzled by the characterization above.

Steve

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 16 May 2005 11:13:41 -0400

Russ,

Looks good except the "intermediate symmetric cipher" in the last paragraph
should be "symmetric cipher" since the symmetric cipher in most cases in not
"intermediate".  Another alternative is to use the term "intermediate
asymmetric cipher", but that might be confusing.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Russ Housley
Sent: Thursday, May 12, 2005 3:21 PM
To: [email-masked]
Subject: Re: key usage - key encipherment or data encipherment

Russ

---

From: Tom Gindin <[email-masked]>
Date: Mon, 16 May 2005 13:26:26 -0400

It should probably just be "without the use of any symmetric 
cipher", instead of wondering whether it's intermediate or not.

                Tom Gindin

"Santosh Chokhani" <[email-masked]>
Sent by: [email-masked]
05/16/2005 11:13 AM
 
        To:     "'Russ Housley'" <[email-masked]>, 
<[email-masked]>
        cc: 
        Subject:        RE: key usage - key encipherment or data 
encipherment

Russ,

Looks good except the "intermediate symmetric cipher" in the last 
paragraph
should be "symmetric cipher" since the symmetric cipher in most cases in 
not
"intermediate".  Another alternative is to use the term "intermediate
asymmetric cipher", but that might be confusing.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
On
Behalf Of Russ Housley
Sent: Thursday, May 12, 2005 3:21 PM
To: [email-masked]
Subject: Re: key usage - key encipherment or data encipherment

      The keyEncipherment bit is asserted when the subject public key is
      used for enciphering private or secret keys, i.e., for key 
transport.
      For example, this bit shall be set when a RSA public key is to be
      used for encrypting a symmetric content-decryption key or an
      asymmetric private key.

Russ

---

From: Michael Ströder <[email-masked]>
Date: Tue, 17 May 2005 18:22:46 +0200

> posting the resulting words.

Since this discussions started by providing examples how about adding a
short example section for demonstrating the appropriate usage of these bits?

Ciao, Michael.