[lamps] draft-ietf-lamps-samples KU check

[Sean Turner <[e-mail]>]

tl;dr: looks good, but I didn’t check the P12 blobs.


Checking for KU bit string and RFC 8813 “compliance”:

s3.1/s3.3 RSA CA certs have KU set to 0000011. This is good; it’s just keyCertSign and cRLSign. I mean you can set more bits but if you don’t have to don’t.

s4.1/s5.1 an RSA sig cert has KU set to 11. This sets both digitalSignature and nonRepudiation. You can set one, the other, or both so this is "good”. I have a slight bias to drop nonRepudiation, but the choice is “compliant”.

s4.2/s5.2 an RSA enc cert has KU set to 001. This is good; it’s just keyEncipherment.


Checking for KU bit string and 8410/draft-ietf-lamps-ku-clarifications "compliance”:

s6.1/6.3 ed25519 CA certs has KU set to 0000011. This is good; it’s just keyCertSign and cRLSign. I mean you can set more bits but if you don’t have to don’t.

s7.1/s8.1 an ed25519 sig cert has KU set to 11. This sets both digitalSignature and nonRepudiation. You can set one, the other, or both so this is "good”. I have a slight bias to drop nonRepudiation, but the choice is “compliant”.

s7.3/8.3 an x25519 enc cert has KU set to 00001. This is good; it’s just keyAgreement.

Cheers,
spt