Clarifications for Elliptic Curve Cryptography Subject Public Key Information
updates
- rfc-5480 — Elliptic Curve Cryptography Subject Public Key Information
Extracted elements (4)
RFC 5480 specified 7 of the 9 key usage values for ECC certificates but made no mention of keyEncipherment and dataEncipherment. RFC 8813 corrects this omission by explicitly prohibiting both bits, since ECC key agreement algorithms do not perform key encipherment or data encipherment.
This document updates RFC 5480 Section 3 by appending explicit prohibition of keyEncipherment and dataEncipherment key usage bits for certificates using id-ecPublicKey, id-ecDH, or id-ecMQV algorithm identifiers, clarifying behavior previously left unspecified.
If the keyUsage extension is present in a certificate that indicates id-ecDH or id-ecMQV in SubjectPublicKeyInfo, then keyEncipherment and dataEncipherment MUST NOT be present.
This document introduces no new security considerations beyond those found in RFC 5480.