[Curdle] [Technical Errata Reported] RFC8410 (9045)

rfc-editor@rfc-editor.org Wed, 29 July 2026 13:50 UTC

Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: rfc-editor@rfc-editor.org
To: ekr@rtfm.com, simon@josefsson.org, daniel.migault@ericsson.com, stndrds-inacio@andrew.cmu.edu, debcooley1@gmail.com
Date: Wed, 29 Jul 2026 13:50:15 -0000
message-id: <178533301589.19.6960320365587474931@rfc-editor.org>
Message-ID-Hash: KGHUGDKAF4ZN2XKHVPFGCCIOG3OVVPBG
CC: info@kajkowalski.nl, curdle@ietf.org, rfc-editor@rfc-editor.org
Precedence: list
Subject: [Curdle] [Technical Errata Reported] RFC8410 (9045)
Archived-At: <https://mailarchive.ietf.org/arch/msg/curdle/PS4DaDdV8I7_8fxzWzgUn4vSGVA>

The following errata report has been submitted for RFC8410,
"Algorithm Identifiers for Ed25519, Ed448, X25519, and X448 for Use in the Internet X.509 Public Key Infrastructure"

--------------------------------------
You may review the report below and at:
https://errata.rfc-editor.org/eid9045/

--------------------------------------
Type: Technical
Reported by: Kaj Kowalski <info@kajkowalski.nl>

Section 9 says:

Original Text
-------------
pk-X25519 PUBLIC-KEY ::= {
        IDENTIFIER id-X25519
        -- KEY no ASN.1 wrapping --
        PARAMS ARE absent
        CERT-KEY-USAGE { keyAgreement }
        PRIVATE-KEY CurvePrivateKey
    }

    KeyWrapAlgorithms KEY-WRAP ::= {
        kwa-aes128-wrap | kwa-aes256-wrap,
        ...
    }

    kaa-X448 KEY-AGREE ::= {
        IDENTIFIER id-X448
        PARAMS ARE absent
        PUBLIC-KEYS {pk-X448}
        UKM -- TYPE no ASN.1 wrapping  -- ARE preferredPresent
        SMIME-CAPS {
           TYPE AlgorithmIdentifier{KEY-WRAP, {KeyWrapAlgorithms}}
           IDENTIFIED BY id-X448 }
    }

    pk-X448 PUBLIC-KEY ::= {
        IDENTIFIER id-X448
        -- KEY no ASN.1 wrapping --
        PARAMS ARE absent
        CERT-KEY-USAGE { keyAgreement }
        PRIVATE-KEY CurvePrivateKey
    }

Corrected Text
--------------
pk-X25519 PUBLIC-KEY ::= {
        IDENTIFIER id-X25519
        -- KEY no ASN.1 wrapping --
        PARAMS ARE absent
        CERT-KEY-USAGE { keyAgreement, encipherOnly, decipherOnly }
        PRIVATE-KEY CurvePrivateKey
    }

    KeyWrapAlgorithms KEY-WRAP ::= {
        kwa-aes128-wrap | kwa-aes256-wrap,
        ...
    }

    kaa-X448 KEY-AGREE ::= {
        IDENTIFIER id-X448
        PARAMS ARE absent
        PUBLIC-KEYS {pk-X448}
        UKM -- TYPE no ASN.1 wrapping  -- ARE preferredPresent
        SMIME-CAPS {
           TYPE AlgorithmIdentifier{KEY-WRAP, {KeyWrapAlgorithms}}
           IDENTIFIED BY id-X448 }
    }

    pk-X448 PUBLIC-KEY ::= {
        IDENTIFIER id-X448
        -- KEY no ASN.1 wrapping --
        PARAMS ARE absent
        CERT-KEY-USAGE { keyAgreement, encipherOnly, decipherOnly }
        PRIVATE-KEY CurvePrivateKey
    }

Notes
-----
This erratum remains applicable after RFC 9295. RFC 9295 Section 3
replaces RFC 8410 Section 5 and normatively requires keyAgreement while
permitting either encipherOnly or decipherOnly to also be present for
certificates whose SubjectPublicKeyInfo identifies X25519 or X448. RFC
9295 does not update the ASN.1 module in RFC 8410 Section 9, where both
pk-X25519 and pk-X448 continue to omit these two permitted bits.

RFC 5912 defines PUBLIC-KEY.&keyUsage as the set of bits legal for the
key type and explicitly states that this set does not express how bits
may be paired. Adding encipherOnly and decipherOnly to CERT-KEY-USAGE
therefore does not permit both bits to be asserted together; RFC 9295
Section 3 continues to govern valid combinations.

The correction is also consistent with RFC 5280 Section 4.2.1.3, which
defines encipherOnly and decipherOnly only in conjunction with
keyAgreement, and with the Diffie-Hellman, KEA, and elliptic-curve key
agreement PUBLIC-KEY definitions in RFC 5912, which list keyAgreement,
encipherOnly, and decipherOnly as legal key-usage bits.

Instructions:
-------------
This erratum is currently posted as "Reported". Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC8410 (draft-ietf-curdle-pkix)
--------------------------------------
Title               : Algorithm Identifiers for Ed25519, Ed448, X25519, and X448 for Use in the Internet X.509 Public Key Infrastructure
Publication Date    : August 2018
Author(s)           : S. Josefsson, J. Schaad
Category            : Proposed Standard
Source              : curdle (sec)
Stream              : IETF
Verifying Party     : IESG

[Curdle] [Technical Errata Reported] RFC8410 (904… rfc-editor