Subject: [lamps] Restricted use of subject names - draft-ietf-lamps-documentsigning-eku-00.txt

From: Stefan Santesson <[email-masked]>
Date: Wed, 19 Jan 2022 08:56:41 +0100

Sean,

I have a hard time understanding what is actually meant by this sentence
of the draft:

"Inclusion of this KeyPurposeId in a certificate indicates that the use
of any Subject names in the certificate is restricted to use by ..."

What does "Subject names" have to do with this, and what exactly is
meant by this restriction?

If I have a certificate with the name "Stefan Santesson", am I allowed
to have another certificate with the same name with another key for
another purpose?

Or what is this sentence trying to tell me?

My understanding of EKU is that this extension in practice tells me that
this certificate (and its public key) is only valid when used in a way
that is consistent with present EKUs. Nothing more and nothing less. How
is that compatible with the sentence above?

-- 
________________
Stefan Santesson