draft-ietf-pkix-rfc3770bis-01: key usage extension

[Russ Housley <[e-mail]>]

Note:  I am starting a separate thread for each of the unresolved 
issues.  I hope this draws more people into the discussion.

Peter:

> > >2 ***
> > >
> > >    If a certificate contains a key usage extension, the KeyUsage bits
> > >    that are needed depends on the EAP method that is employed; however,
> > >    the keyCertSign bit and the cRLSign MUST NOT be associated with EAP
> > >    method end entity certificates.
> > >
> > >This means that you cannot have a certificat WITHOUT keyUsage?
> > >Or, in case of a certificate without keyUsage, you could use it
> > >for CrlSigning?
> >
> > No.  The paragraph only talks about the key usage extension in support of
> > EAP methods.  The question you are asking is beyond the scope of the
> > paragraph and the whole document.
> >
>
>oops, I made a mistake. i wanted to ask "could you use a certificate
>that has no keyUsage for EAP methods?'

Yes.  In this case, the certificate is not providing any constraints on the 
key usage.

Russ