Re: [Curdle] [Technical Errata Reported] RFC8410 (5696)

I do not think this is correct.  A CA could, for example, use one key for signing certificates and a separate key for signing CRLs.

Russ

> On Apr 17, 2019, at 9:03 AM, RFC Errata System <rfc-editor@rfc-editor.org> wrote:
> 
> The following errata report has been submitted for RFC8410,
> "Algorithm Identifiers for Ed25519, Ed448, X25519, and X448 for Use in the Internet X.509 Public Key Infrastructure".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata/eid5696
> 
> --------------------------------------
> Type: Technical
> Reported by: Lijun Liao <LIJUN.LIAO@HUAWEI.COM>
> 
> Section: 5
> 
> Original Text
> -------------
>   If the keyUsage extension is present in a certification authority
>   certificate that indicates id-Ed25519 or id-Ed448, then the keyUsage
>   extension MUST contain one or more of the following values:
> 
>          nonRepudiation;
>          digitalSignature;
>          keyCertSign; and
>          cRLSign.
> 
> Corrected Text
> --------------
>   If the keyUsage extension is present in a certification authority
>   certificate that indicates id-Ed25519 or id-Ed448, then the keyUsage
>   extension MUST contain keyCertSign, and zero, one or more of the
>   following values:
> 
>          nonRepudiation;
>          digitalSignature; and
>          cRLSign.
> 
> Notes
> -----
> The usage keyCertSign must be set in a CA certificate.
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party  
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC8410 (draft-ietf-curdle-pkix-10)
> --------------------------------------
> Title               : Algorithm Identifiers for Ed25519, Ed448, X25519, and X448 for Use in the Internet X.509 Public Key Infrastructure
> Publication Date    : August 2018
> Author(s)           : S. Josefsson, J. Schaad
> Category            : PROPOSED STANDARD
> Source              : CURves, Deprecating and a Little more Encryption
> Area                : Security
> Stream              : IETF
> Verifying Party     : IESG
> 
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle