Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Google Chrome gives a lot of SSL information. Here is a screenshot:

enter image description here

Under "Key Usage", what does "Derive" mean?

share|improve this question
Are you able to provide the OID of the key usages (e.g. – Bernie White Feb 3 '13 at 9:55
Purpose 1 is and purpose 2 is – Randomblue Feb 3 '13 at 12:15
up vote 5 down vote accepted

It is not a Chrome popup; it is a MacOS X popup. Chrome delegates certificate management to the underlying OS. You get this popup only with Chrome on MacOS X (on Linux you will have the Gnome certificate viewer, on Windows the Windows certificate viewer).

The OS X certificate viewer shows the "Key Usages" which are defined in the "Key Usage extension" as specified in RFC 5280, section This (optional) extension describe the usages for which the public key contained in the certificate may be used. OS X translates the combination of flags into a combination of "usage words" and there is not a 1-to-1 mapping. You get "Derive" when the keyAgreement key usage is specified (which is normal for a SSL server certificate with a RSA key); to get "Encrypt", you need either the dataEncipherment flag, or the combination of keyAgreement and keyEncipherment. keyEncipherment triggers "Wrap". You also get "Encrypt, Verify, Derive" if the key has type RSA and there is no Key Usage extension at all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.