Re: [lamps] RFC 5480 clarification for KeyUsages: keyEncipherment and dataEncipherment

> -----Original Message-----
> From: Spasm <spasm-bounces@ietf.org> On Behalf Of Russ Housley
> Sent: Sunday, March 24, 2019 7:33 AM
> To: Sean Turner <sean@sn3rd.com>
> Cc: spasm@ietf.org
> Subject: Re: [lamps] RFC 5480 clarification for KeyUsages: keyEncipherment
> and dataEncipherment
> 
> Sean:
> >
> > RFC 5480 enumerates the KeyUsage values that are included for an EC key:
> > https://tools.ietf.org/html/rfc5480#section-3
> > But, we neglected to mention keyEncipherment and dataEncipherment.
> Does that mean these values MAY be included, MUST NOT be included, or
> something else?  And, is this worth spinning a short draft to clarify RFC
5480?
> 
> My understanding is that the algorithms in RFC 5480 are key agreement and
> digital signature algorithms, so neither keyEncipherment and
> dataEncipherment are appropriate.  I read it as these bits MUST NOT be
set.

My reading is that if nothing is said, then nothing is said.  I would agree
that these bits make no sense in general, but this is a public key so there
may be an algorithm which uses the EC key and does keyEncipherment.  In this
case it would be appropriate to have them set.  Think of an algorithm
identifier which is KeyAgree+KDF+KeyWrap as a single OID.  These two bits
however were created for algorithms which the IETF has never looked at
using.

Jim

> 
> Russ
> 
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm