3

I am requesting for real life example of using the encipheronly or decipheronly bits together with the keyAgreement bit in the keyUsage field of a X.509 certificate. The RFC 5280 specifies about these bits as follows: "he meaning of the encipherOnly bit is undefined in the absence of the keyAgreement bit. When the encipherOnly bit is asserted and the keyAgreement bit is also set, the subject public key may be used only for enciphering data while performing key agreement.

  The meaning of the decipherOnly bit is undefined in the absence of
  the keyAgreement bit.  When the decipherOnly bit is asserted and
  the keyAgreement bit is also set, the subject public key may be
  used only for deciphering data while performing key agreement."

I am trying to find real life examples ( not for an assignment or for teaching someone , but only for teaching myself ) , could someone help with key agreement examples where these bits are set. I know of ECDH-ES key agreement where the static public key can be distributed as a certificate, but the public key is not used for encrypting or decrypting data. Are there any other key agreement protocols that require the public key be used for encrypting ( aka IMHO enciphering ) /decrypting ( aka deciphering IMHO ) data during key agreement? if yes, can you please help me understand with examples?

  • KEM in CMS (S/MIME) would be an example for encrypting a key to the recipients certificate. But support for key usage and extended usage are very often very lacking. – eckes Mar 16 at 3:24

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.