Diff: rfc9295v3.txt - rfc9295.txt

	rfc9295v3.txt	rfc9295.txt

	Internet Engineering Task Force (IETF) S. Turner	Internet Engineering Task Force (IETF) S. Turner
	Request for Comments: 9295 sn3rd	Request for Comments: 9295 sn3rd
	Updates: 8410 S. Josefsson	Updates: 8410 S. Josefsson
	Category: Standards Track SJD AB	Category: Standards Track SJD AB
	ISSN: 2070-1721 D. McCarney	ISSN: 2070-1721 D. McCarney
	Square Inc.	Square Inc.
	T. Ito	T. Ito
	SECOM CO., LTD.	SECOM CO., LTD.

	August 2022	September 2022

	Clarifications for Ed25519, Ed448, X25519, and X448 Algorithm	Clarifications for Ed25519, Ed448, X25519, and X448 Algorithm
	Identifiers	Identifiers

	Abstract	Abstract

	This document updates RFC 8410 to clarify existing semantics, and	This document updates RFC 8410 to clarify existing semantics, and
	specify missing semantics, for key usage bits when used in	specify missing semantics, for key usage bits when used in
	certificates that support the Ed25519, Ed448, X25519, and X448	certificates that support the Ed25519, Ed448, X25519, and X448
	Elliptic Curve Cryptography algorithms.	Elliptic Curve Cryptography algorithms.

	skipping to change at line 101 ¶	skipping to change at line 101 ¶
	id-X25519 or id-X448 in SubjectPublicKeyInfo, then the following MUST	id-X25519 or id-X448 in SubjectPublicKeyInfo, then the following MUST
	be present:	be present:

	keyAgreement	keyAgreement

	One of the following MAY also be present:	One of the following MAY also be present:

	encipherOnly	encipherOnly
	decipherOnly	decipherOnly


	and the following MUST NOT be present:	and any of the following MUST NOT be present:

	digitalSignature	digitalSignature
	nonRepudiation	nonRepudiation
	keyEncipherment	keyEncipherment
	dataEncipherment	dataEncipherment
	keyCertSign	keyCertSign
	cRLSign	cRLSign

	If the keyUsage extension is present in an end-entity certificate	If the keyUsage extension is present in an end-entity certificate
	that indicates id-Ed25519 or id-Ed448 in SubjectPublicKeyInfo, then	that indicates id-Ed25519 or id-Ed448 in SubjectPublicKeyInfo, then
	the keyUsage extension MUST contain at least one of the following:	the keyUsage extension MUST contain at least one of the following:

	nonRepudiation	nonRepudiation
	digitalSignature	digitalSignature
	cRLSign	cRLSign


	and the following MUST NOT be present:	and any of the following MUST NOT be present:

	keyEncipherment	keyEncipherment
	dataEncipherment	dataEncipherment
	keyAgreement	keyAgreement
	keyCertSign	keyCertSign
	encipherOnly	encipherOnly
	decipherOnly	decipherOnly

	If the keyUsage extension is present in a CRL issuer certificate that	If the keyUsage extension is present in a CRL issuer certificate that
	indicates id-Ed25519 or id-Ed448 in SubjectPublicKeyInfo, then the	indicates id-Ed25519 or id-Ed448 in SubjectPublicKeyInfo, then the
	keyUsage extension MUST contain:	keyUsage extension MUST contain:

	cRLSign	cRLSign

	and zero or more of the following:	and zero or more of the following:

	nonRepudiation	nonRepudiation
	digitalSignature	digitalSignature


	and the following MUST NOT be present:	and any of the following MUST NOT be present:

	keyEncipherment	keyEncipherment
	dataEncipherment	dataEncipherment
	keyAgreement	keyAgreement
	encipherOnly	encipherOnly
	decipherOnly	decipherOnly

	and if the CRL issuer is also a certification authority, then the	and if the CRL issuer is also a certification authority, then the
	keyUsage extension MUST also contain:	keyUsage extension MUST also contain:


	skipping to change at line 163 ¶	skipping to change at line 163 ¶
	SubjectPublicKeyInfo, then the keyUsage extension MUST contain:	SubjectPublicKeyInfo, then the keyUsage extension MUST contain:

	keyCertSign	keyCertSign

	and zero or more of the following:	and zero or more of the following:

	nonRepudiation	nonRepudiation
	digitalSignature	digitalSignature
	cRLSign	cRLSign


	and the following MUST NOT be present:	and any of the following MUST NOT be present:

	keyEncipherment	keyEncipherment
	dataEncipherment	dataEncipherment
	keyAgreement	keyAgreement
	encipherOnly	encipherOnly
	decipherOnly	decipherOnly

	4. Security Considerations	4. Security Considerations

	This document introduces no new security considerations beyond those	This document introduces no new security considerations beyond those

End of changes. 5 change blocks.
	5 lines changed or deleted	5 lines changed or added
This html diff was produced by rfcdiff 1.48.