Netscape Certificate Management System 6.0, Manual

Page: 186 / 377

KeyUsageExt Plug-in Module
186 Netscape Certificate Management System Plug-Ins Guide • March 2002
KeyUsageExt Plug-in Module
The
KeyUsageExt
plug-in module implements the key usage extension policy. This
policy enables you to configure Certificate Management System to add the Key
Usage Extension defined in X.509 and PKIX standard RFC 2459 (see
http://www.ietf.org/rfc/rfc2459.txt
) to certificates. The extension specifies
the purposes for which the key contained in a certificate should be used—for
example, it specifies whether the key should be used for data signing, key
encipherment, or data encipherment—and thus enables you to restrict the usage of
a key pair to predetermined purposes.
The key usage extension is a string of boolean bit-flags, each bit identifying the
purpose for which a key is to be used. Table 4-13 lists the bits and their designated
purposes.
You can restrict the purposes for which a key pair (and thus the corresponding
certificate) should be used by setting the appropriate key-usage bits. For example,
if you want to restrict a key pair to be used for digital signature only, when issuing
the certificate you would add the key usage extension to the certificate with
digital_signature
bit (or bit 0) set. For general guidelines on setting the key
usage extension in certificates, see “keyUsage” on page 348.
Table 4-13 Key usage extension bits and designated purposes
Bit Purpose
0 digitalSignature
1 nonRepudiation
2 keyEncipherment
3 dataEncipherment
4 keyAgreement
5 keyCertSign
6 cRLSign
7 encipherOnly
8 decipherOnly