id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }

      KeyUsage ::= BIT STRING {
           digitalSignature        (0),
           nonRepudiation          (1),
           keyEncipherment         (2),
           dataEncipherment        (3),
           keyAgreement            (4),
           keyCertSign             (5),




 
RFC 2459        Internet X.509 Public Key Infrastructure    January 1999


           cRLSign                 (6),
           encipherOnly            (7),
           decipherOnly            (8) }


   Bits in the KeyUsage type are used as follows:

      The digitalSignature bit is asserted when the subject public key
      is used with a digital signature mechanism to support security
      services other than non-repudiation (bit 1), certificate signing
      (bit 5), or revocation information signing (bit 6). Digital
      signature mechanisms are often used for entity authentication and
      data origin authentication with integrity.

      The nonRepudiation bit is asserted when the subject public key is
      used to verify digital signatures used to provide a non-
      repudiation service which protects against the signing entity
      falsely denying some action, excluding certificate or CRL signing.

      The keyEncipherment bit is asserted when the subject public key is
      used for key transport.  For example, when an RSA key is to be
      used for key management, then this bit shall asserted.

      The dataEncipherment bit is asserted when the subject public key
      is used for enciphering user data, other than cryptographic keys.

      The keyAgreement bit is asserted when the subject public key is
      used for key agreement.  For example, when a Diffie-Hellman key is
      to be used for key management, then this bit shall asserted.

      The keyCertSign bit is asserted when the subject public key is
      used for verifying a signature on certificates.  This bit may only
      be asserted in CA certificates.

      The cRLSign bit is asserted when the subject public key is used
      for verifying a signature on revocation information (e.g., a CRL).

      The meaning of the encipherOnly bit is undefined in the absence of
      the keyAgreement bit.  When the encipherOnly bit is asserted and
      the keyAgreement bit is also set, the subject public key may be
      used only for enciphering data while performing key agreement.

      The meaning of the decipherOnly bit is undefined in the absence of
      the keyAgreement bit.  When the decipherOnly bit is asserted and
      the keyAgreement bit is also set, the subject public key may be
      used only for deciphering data while performing key agreement.






 
RFC 2459        Internet X.509 Public Key Infrastructure    January 1999


   This profile does not restrict the combinations of bits that may be
   set in an instantiation of the keyUsage extension.  However,
   appropriate values for keyUsage extensions for particular algorithms
   are specified in section 7.3.

4.2.1.4  Private Key Usage Period

   This profile recommends against the use of this extension.  CAs
   conforming to this profile MUST NOT generate certificates with
   critical private key usage period extensions.

   The private key usage period extension allows the certificate issuer
   to specify a different validity period for the private key than the
   certificate. This extension is intended for use with digital
   signature keys.  This extension consists of two optional components,
   notBefore and notAfter.  The private key associated with the
   certificate should not be used to sign objects before or after the
   times specified by the two components, respectively. CAs conforming
   to this profile MUST NOT generate certificates with private key usage
   period extensions unless at least one of the two components is
   present.

   Where used, notBefore and notAfter are represented as GeneralizedTime
   and MUST be specified and interpreted as defined in section
   4.1.2.5.2.