[Errata Held for Document Update] RFC3279 (6672)

The following errata report has been held for document update 
for RFC3279, "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile". 

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6672

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Jaime Hablutzel <[email protected]>
Date Reported: 2021-09-01
Held by: Paul Wouters (IESG)

Section: 2.3.5

Original Text
-------------
If the keyUsage extension is present in a CA or CRL issuer certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation; and
keyAgreement.

If the keyAgreement value is present, either of the following values MAY be present:

encipherOnly; and
decipherOnly.

The keyUsage extension MUST NOT assert both encipherOnly and decipherOnly.

If the keyUsage extension is present in a CA certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation;
keyAgreement;
keyCertSign; and
cRLSign.

Corrected Text
--------------
If the keyUsage extension is present in an end entity certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation; and
keyAgreement.

If the keyAgreement value is present, either of the following values MAY be present:

encipherOnly; and
decipherOnly.

The keyUsage extension MUST NOT assert both encipherOnly and decipherOnly.

If the keyUsage extension is present in a CA or CRL issuer certificate which conveys an elliptic curve public key, any combination of the following values MAY be present:

digitalSignature;
nonRepudiation;
keyAgreement;
keyCertSign; and
cRLSign.


Notes
-----
- "a CA or CRL issuer certificate" is replaced by "an end entity certificate"
- "CA certificate" is replaced by "CA or CRL issuer certificate"

The need for this correction can be confirmed from RFC 5480, "3. Key Usage Bits".

Corrected wording has been copied from the section "2.3.1 RSA Keys" of this RFC 3279 itself.

Paul Wouters (AD): As 5480 updates 3279, this errata is resolved 

--------------------------------------
RFC3279 (draft-ietf-pkix-ipki-pkalgs-05)
--------------------------------------
Title               : Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Publication Date    : April 2002
Author(s)           : L. Bassham, W. Polk, R. Housley
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG