[lamps] draft-ietf-lamps-8410-ku-clarifications: EE/CRLIssuer Text

[Sean Turner <[e-mail]>]

Hi! During IESG review we got comments from a couple of couple of ADs (3) about EE/CRL issue text (note this is NOT a DISCUSS but if we tripped up 3 then it’s probably worth having a look at):

   If the keyUsage extension is present in an end-entity or CRL issuer
   certificate that indicates id-Ed25519 or id-Ed448 in
   SubjectPublicKeyInfo, then the keyUsage extension MUST contain at
   least one of the following:

     nonRepudiation;
     digitalSignature; and
     cRLSign;

and the following MUST NOT be present:

     keyEncipherment;
     dataEncipherment;
     keyAgreement;
     keyCertSign;
     encipherOnly; and
     decipherOnly.

One way to fix this is to make the following changes to separate out the EE and CRL issuer:

   If the keyUsage extension is present in an end-entity
   certificate that indicates id-Ed25519 or id-Ed448 in
   SubjectPublicKeyInfo, then the keyUsage extension MUST contain at
   least one of the following:

     nonRepudiation; and
     digitalSignature;

and the following MUST NOT be present:

     keyEncipherment;
     dataEncipherment;
     keyAgreement;
     keyCertSign;
     encipherOnly; and
     decipherOnly.
….

Also ADD:

   If the keyUsage extension is present in an CRL issuer
   certificate that indicates id-Ed25519 or id-Ed448 in
   SubjectPublicKeyInfo, then the keyUsage extension MUST contain at
   least one of the following:

     nonRepudiation;
     digitalSignature; and
     cRLSign;

and the following MUST NOT be present:

     keyEncipherment;
     dataEncipherment;
     keyAgreement;
     keyCertSign;
     encipherOnly; and
     decipherOnly.

Open to other suggestions as well.

Cheers,
spt