Confused about RFC 4492: difference between "ECDH-capable public key" and "ECDSA-capable public key"

Question

As per section 5.3 of RFC 4492, I'm confused with the following table:

          Key Exchange Algorithm  Server Certificate Type
      ----------------------  -----------------------

      ECDH_ECDSA              Certificate MUST contain an
                              ECDH-capable public key.  It
                              MUST be signed with ECDSA.

      ECDHE_ECDSA             Certificate MUST contain an
                              ECDSA-capable public key.  It
                              MUST be signed with ECDSA.

      ECDH_RSA                Certificate MUST contain an
                              ECDH-capable public key.  It
                              MUST be signed with RSA.

      ECDHE_RSA               Certificate MUST contain an
                              RSA public key authorized for
                              use in digital signatures.  It
                              MUST be signed with RSA.

Specifically, I would like to know about the difference between

ECDH-capable public key

and

ECDSA-capable public key

What actually defines an EC*-capable public key and what are the differences between the two?

I am using XCA/OpenSSL and have configured a CA and signed server certificate to use a prime256v1/P-256 EC key. Then, I will have a client/server using the following cipher suites:

TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

and

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

Answer 1

That wording is an abbreviation; the key is (or keys are) actually the same, the difference is whether the certificate allows use of the key for the relevant purpose. See section 2:

Note that there is no structural difference between ECDH and ECDSA keys. A certificate issuer may use X.509 v3 keyUsage and extendedKeyUsage extensions to restrict the use of an ECC public key to certain computations [15]. This document refers to an ECC key as ECDH-capable if its use in ECDH is permitted. ECDSA-capable is defined similarly.

[15] refers to rfc3280, which has been superseded by rfc5280. If the KeyUsage extension is present in the cert, it has the digitalSignature bit set to allow use of the subject key for ECDSA, and/or the keyAgreement bit set to allow use of the subject key for ECDH. If KeyUsage is not present, the key can be used for any purpose otherwise acceptable to the program(s) using the certificate.

In principle ExtendedKeyUsage can also be used, but I'm not aware of any EKU values defined -- and more to the point, implemented by common software -- for these specific usages. (There are lots of EKU values defined for other things, including distinguishing server SSL/TLS from client SSL/TLS.)