Subject: [TLS] Enforcing keyUsage restrictions (was Re: Safe ECC usage)

From: Brian Smith <[email-masked]>
Date: Fri, 11 Oct 2013 17:51:19 -0700

On Thu, Oct 3, 2013 at 5:23 AM, Peter Gutmann <[email-masked]> wrote:
> My code, in its default configuration, strictly enforces keyUsage.  From this
> I've found that both applications and CAs can set these bits more or less at
> random, including completely illogical settings like keyAgreement for RSA
> keys.  I've also found, through trial-and-error, that many applications
> completely ignore them and use the keys in whatever way they feel appropriate
> (the situation for PKCS #12 files in particular is so bad that after fighting
> it for awhile I had to turn off checking of keyUsage entirely).  So this isn't
> a case of copying an RSA template, it's broken software generating them and
> equally broken software ignoring them.

Software based on NSS's libssl has a pretty liberal interpretation of
keyUsage, and this is something I'd like to correct in Firefox soon.
In particular, I want to encourage CAs to offer ECDSA SSL certificates
only with the digitalSignature bit set, and to provide the option to
their customers to request RSA certificates with only the
digitalSignature bit set. This should provide defense-in-depth from
server misconfiguration for websites that want to switch exclusively
to ephemeral key exchange.

If you have any more specific information you could share regarding
your experience with attempting strict(er) KU enforcement, it would be
great if you could share it. (Not just Peter, but everybdoy.)

Cheers,
Brian
-- 
Mozilla Networking/Crypto/Security (Necko/NSS/PSM)

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 12 Oct 2013 04:15:44 +0000

Brian Smith <[email-masked]> writes:

>If you have any more specific information you could share regarding your
>experience with attempting strict(er) KU enforcement, it would be great if
>you could share it. (Not just Peter, but everybdoy.)

What were you after in general?  I've just encountered lots of certs with
keyUsage bits that either prevented them from being used in the manner that
they were intended for (e.g. DS for an encryption key), or were illogical (the
aforementioned keyAgreement for an RSA key), or contradictory (kU said one
thing, eKU said another).  Here's one example, from an intermediate CA using
RSA, directly signed by a trusted root CA:

 624   14:         SEQUENCE {
 626    3:           OBJECT IDENTIFIER keyUsage (2 5 29 15)
 631    1:           BOOLEAN TRUE
 634    4:           OCTET STRING, encapsulates {
 636    2:             BIT STRING 1 unused bit
         :               '1111111'B
         :             }
         :           }

Peter.