360425 - support single-usage keys

Status: RESOLVED INACTIVE

(NSS :: Libraries, enhancement, P5)

Description

[Nelson Bolyard (seldom reads bugmail)]

NIST has proposed to require that any public or private key be usable 
only for signing, or only for encryption (e.g. key wrapping, key transport), 
but not for both.  

This would be a requirement of a future revision of FIPS 140.

Our PKCS#11 module has the ability to create such single-usage keys,
and to record that keys are single usage (I think), but many of NSS's
APIs for requesting keys have no ability to request this single usage.

AFAIK, we have no way to request the generation of a key pair where the 
generated keys will be usable only for signature and not for encryption,
or vice versa.  It is also not clear that we have any way to ensure that
a certificate request for a single usage key will request a cert whose
extensions identify it as valid only for that single usage.  

This strikes me as a bigger enhancement than the enhancement for 
single-usage certs in libSSL.  It affects tools also.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Bug 360600 is one manifestation of this issue

Comment 2

[glen beasley]

removed from FIPS2009. will consider for future release.