Re: [pkix] A non-compliant use of the EKU extension in Mozilla's CA Certificate Policy Version 2.1.

["Piyush Jain" <[e-mail]>]

Where is the conflict with X.509? There is not eveb a problem with PKIX's
> definitions of concrete values IMO. In fact, PKIX has no semantics
defined,
> just a comment to the ASN.1 syntax.  As Peter Gutman mentioned 'email
> protection' means what?
> There is no conflict IMO with existing specs if one would say:
> 
> - email protection means xyz. If put into and end certficate, then the
cert can
> only
>    be used for that purpose, if put into a CA cert, than this extend the
path
> validation
>    algorithm, such a CA is only supposed to issue certs that have this EKU
in EE
> certs.
> 
The conflict is that some implementations have started deducing the extended
key usage of a certificate based on what EKU is present in other
certificates up in the chain.

Semantic of an extension with OID id-ce-extKeyUsage is clear. 5280 clearly
defines how this extension should be processed and that it applies only to
the certificate in which it is present.
What it does not defined is the meaning of objects contained within the EKU
extension because those meanings are application dependent - however this is
not the point that is being argued.

The way I see it, the purposeIDs that are defined in 5280 do not belong
there. Those definitions should have been part of application protocol
specification.

The fact that some of the purpose IDs are not being enforced by applications
has nothing to do with how applications deduce the purpose associated with a
cert.