Subject: Re: [TLS] Safe ECC usage

From: Peter Gutmann <[email-masked]>
Date: Thu, 3 Oct 2013 12:23:11 +0000

Santosh Chokhani <[email-masked]> writes:

>Simply copying RSA template and thus the key usage bits should not yield the
>behavior you mention.  RSA certificates should set the key encipherment bit.
>EC type certificates should not set that bit; the appropriate bit is key
>agreement.

My code, in its default configuration, strictly enforces keyUsage.  From this
I've found that both applications and CAs can set these bits more or less at
random, including completely illogical settings like keyAgreement for RSA
keys.  I've also found, through trial-and-error, that many applications
completely ignore them and use the keys in whatever way they feel appropriate
(the situation for PKCS #12 files in particular is so bad that after fighting
it for awhile I had to turn off checking of keyUsage entirely).  So this isn't
a case of copying an RSA template, it's broken software generating them and
equally broken software ignoring them.

Peter.