Clarifications for Ed25519, Ed448, X25519, and X448 Algorithm Identifiers
updates
- rfc-8410 — Algorithm Identifiers for Ed25519, Ed448, X25519, and X448 for Use in the Internet X.509 Public Key Infrastructure
Extracted elements (14)
RFC 8410 defined permissible keyUsage combinations for these algorithms but did not define which values are impermissible, nor did it address keyEncipherment or dataEncipherment. This document fills those gaps by replacing Section 5 of RFC 8410 with explicit MUST NOT constraints.
Errata 5696 against RFC 8410 clarified that keyCertSign must always be set in certification authority certificates for Ed25519/Ed448. This document incorporates that clarification normatively.
X25519 and X448 are key agreement algorithms and MUST NOT carry digitalSignature or nonRepudiation bits; Ed25519 and Ed448 are signature algorithms and MUST NOT carry keyAgreement bits. Mixing these bit patterns across algorithm types indicates a misconfigured certificate.
For Ed25519/Ed448 CA certificates, keyEncipherment, dataEncipherment, keyAgreement, encipherOnly, and decipherOnly MUST NOT be present.
For Ed25519/Ed448 CRL issuer certificates, keyEncipherment, dataEncipherment, keyAgreement, encipherOnly, and decipherOnly MUST NOT be present.
For Ed25519/Ed448 end-entity certificates, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, encipherOnly, and decipherOnly MUST NOT be present.
For X25519/X448 certificates, encipherOnly or decipherOnly MAY also be present alongside keyAgreement.
For X25519/X448 certificates, the keyUsage bits digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyCertSign, and cRLSign MUST NOT be present.
If a CRL issuer certificate for id-Ed25519 or id-Ed448 is also a certification authority, then the keyUsage extension MUST also contain keyCertSign.
If keyUsage is present in a certification authority certificate indicating id-Ed25519 or id-Ed448, the extension MUST contain keyCertSign.
If keyUsage is present in a CRL issuer certificate indicating id-Ed25519 or id-Ed448, the extension MUST contain cRLSign.
If keyUsage is present in an end-entity certificate indicating id-Ed25519 or id-Ed448, the extension MUST contain at least one of: nonRepudiation, digitalSignature, or cRLSign.
If the keyUsage extension is present in a certificate indicating id-X25519 or id-X448, then keyAgreement MUST be present.
This document introduces no new security considerations beyond those found in RFC 8410. The clarifications are purely semantic and do not alter the cryptographic properties of the algorithms.