Subject: [ietf-tls] Extended Key Usage extension in server cert

From: Vipul Gupta <[email-masked]>
Date: Mon, 19 Mar 2001 11:57:29 -0800 (PST)

I've noticed that trading.etrade.com sends a X509.v3 
  server certificate in which the extended key usage extension
  looks like:

   <Id: 551d25,  (Extended Key Usage)
   
    Value: 0x3017060a6086480186f84501080106096086480186f8420401>
    
  Looks like the value has a sequence of two OIDs
  
      30 17:  Sequence of length 23
      
             06 0a:  OID of length 10
             
                     0x6086480186f845010801
                     
             06 09: OID of length 9
             
                     0x6086480186f8420401
                     
  Based on my understanding of RFC 2459, this does not appear
  to encode any of the extended key usage bits specified in
  Section 4.2.1.13.
  
  Can someone with more experience with SSL/TLS server certifcates
  comment on what this is?
  
  thanks,
  
  vipul

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: "David P. Kemp" <[email-masked]>
Date: Mon, 19 Mar 2001 16:36:56 -0500

0000 30 17      : SEQUENCE length = 23 
0002 06 0a      : . OID 2.16.840.1.113733.1.8.1
0014 06 09      : . OID 2.16.840.1.113730.4.netscapeServerGatedCrypto(1)

The first OID is VeriSign's.  An old PKIX message:

  From: Alex Deacon <[email-masked]> 
  Date: Tue, 30 Nov 1999 15:37:26 -0800 
  Cc: [email-masked] 

contained:

  --
  -- VeriSign defined certificate policy identifier sub tree
  --  (2.16.840.1.113733.1.7)
  --   
  id-policies OBJECT IDENTIFIER ::= {id-pki policies(7)}

  --
  -- VeriSign defined attribute sub tree
  --  (2.16.840.1.113733.1.9)
  --   
  id-attributes   OBJECT IDENTIFIER ::= {id-pki attributes(9)}

but had nothing on 2.16.840.1.113733.1.8

The second OID was a way to allow export browsers to use strong
crypto for financial applications without enabling it for general
use.  It is no longer necessary.

---

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 24 Mar 2001 03:54:56 (NZST)

>but had nothing on 2.16.840.1.113733.1.8

2 16 840 1 113733 1 8 1 is a Verisign SGC OID.

Peter.

---