RFC 6120 CA cert keyUsage digitalSignature bit requirement?
Simon Josefsson <[email protected]> Wed, 13 Aug 2014 22:55:13 +0200
| Newsgroups | gmane.ietf.xmpp |
|---|---|
| Message-ID | <[email protected]> |
Hi,
I'm generating certificates for use in a XMPP environment, and I'm
seeking clarification of one aspect of RFC 6120:
The following rules apply to certification authority (CA)
certificates that are used by issuers of XMPP end entity
certificates:
...
2. The certificate MUST contain a keyUsage extension with the
digitalSignature bit set.
My question: Why is the digitalSignature bit a requirement?
Speculation: Was the keyCertSign bit intended here? Reading RFC 5280 it
seems the keyCertSign would be more appropriate than digitalSignature.
What non-certificate/CRL objects is it that XMPP environments expect to
be signed by the CA?
KeyUsage ::= BIT STRING {
digitalSignature (0),
...
keyCertSign (5),
...
The digitalSignature bit is asserted when the subject public key
is used for verifying digital signatures, other than signatures on
certificates (bit 5) and CRLs (bit 6), such as those used in an
entity authentication service, a data origin authentication
service, and/or an integrity service.
...
The keyCertSign bit is asserted when the subject public key is
used for verifying signatures on public key certificates. If the
keyCertSign bit is asserted, then the cA bit in the basic
constraints extension (Section 4.2.1.9) MUST also be asserted.
...
If the keyUsage extension is present, then the subject public key
MUST NOT be used to verify signatures on certificates or CRLs unless
the corresponding keyCertSign or cRLSign bit is set. If the subject
public key is only to be used for verifying signatures on
certificates and/or CRLs, then the digitalSignature and
nonRepudiation bits SHOULD NOT be set. However, the digitalSignature
and/or nonRepudiation bits MAY be set in addition to the keyCertSign
and/or cRLSign bits if the subject public key is to be used to verify
signatures on certificates and/or CRLs as well as other objects.
Thanks,
/Simon