Do not require CA KU existence

diff --git a/c/cmd/cer-verify/cer-verify.c b/c/cmd/cer-verify/cer-verify.c
index bb3f6ce1596562604c5575b01a1b7c044e257318d45284c56ea81f0f475e40e5..f303c0d49e4f512b14c6d0f9c29dfad4b89a61332912784e0d5b47d65b8e217c 100644 (file)
--- a/c/cmd/cer-verify/cer-verify.c
+++ b/c/cmd/cer-verify/cer-verify.c
@@ -95,13 +95,6 @@ main(int argc, char **argv)
             fputs("ok\n", stdout);
             break;
         }
-        {
-            size_t ku = KEKSItemsGetByKey(&(verifier->items), verifier->load, "ku");
-            if ((ku == 0) || KEKSItemsGetByKey(&(verifier->items), ku, "ca") == 0) {
-                fputs("no ca ku\n", stdout);
-                return EXIT_FAILURE;
-            }
-        }
         fputs("ok\n", stdout);
         toVerify = verifier;
     }

diff --git a/go/pki/cer.go b/go/pki/cer.go
index e6a349184d32f89431cd12a5ee4aa20aef4146af601ded542e510b9981151a5a..1bd90c77ff2f153f3edc101bac8b7011ffa8023a0e002e4c6b8468406bf66b5d 100644 (file)
--- a/go/pki/cer.go
+++ b/go/pki/cer.go
@@ -31,7 +31,6 @@ import (
 )
 
 const (
-       KUCA     = "ca"  // CA-capable key usage
        KUSig    = "sig" // Signing-capable key usage
        KUKEM    = "kem" // Key-encapsulation-mechanism key usage
        CerMagic = keks.Magic("pki/cer")
@@ -307,10 +306,6 @@ func (signed *Signed) CerVerify(cers []*Signed, t time.Time) (err error) {
                        err = errors.New("cer can not sign")
                        return
                }
-               if !cerLoad.Can(KUCA) {
-                       err = errors.New("cer can not ca")
-                       return
-               }
                idToCer[cerLoad.Pub[0].Id] = cer
        }
        signer := idToCer[sid]

diff --git a/go/pki/cmd/certool/basic.t b/go/pki/cmd/certool/basic.t
index 20da835189bf13144986a5e834cb522780692cd55c5f7aecd13630444f22ceac..705dd6e97fd9d67a017b81bd232152c046dac3d2e515ddeb286407479d2a3b70 100755 (executable)
--- a/go/pki/cmd/certool/basic.t
+++ b/go/pki/cmd/certool/basic.t
@@ -11,7 +11,7 @@ ed25519-blake2b ed25519-blake2b" | while read caAlgo eeAlgo ; do
 subj="-subj CN=CA -subj C=RU"
 test_expect_success "$caAlgo: CA load generation" "certool \
     -algo $caAlgo \
-    -ku ca -ku sig $subj \
+    -ku sig $subj \
     -prv $TMPDIR/ca.prv -cer $TMPDIR/ca.cer"
 test_expect_success "$caAlgo: CA generation" "certool \
     -cer $TMPDIR/ca.cer \
@@ -27,7 +27,7 @@ test_expect_success "$caAlgo: CA self-signature" "certool \
 subj="-subj CN=SubCA -subj C=RU"
 test_expect_success "$eeAlgo: SubCA load generation" "certool \
     -algo $eeAlgo \
-    -ku ca -ku sig $subj \
+    -ku sig $subj \
     -prv $TMPDIR/subca.prv -cer $TMPDIR/subca.cer"
 test_expect_success "$eeAlgo: SubCA generation" "certool \
     -cer $TMPDIR/subca.cer \

diff --git a/spec/format/cer-load.cddl b/spec/format/cer-load.cddl
index 8e3e2285c7e1b83dcacfd79443928bb7885b8e71feaf87b616036a4a924cbee4..ea648362164582fd0f66eb56c66f941ea8716dfff2d411c86dd99a0351d63312 100644 (file)
--- a/spec/format/cer-load.cddl
+++ b/spec/format/cer-load.cddl
@@ -9,5 +9,5 @@ cer-load = {
     * text => any
 }
 
-ku = "ca" / "sig" / "kem" / "app-name" / text
+ku = "sig" / "kem" / "app-name" / text
 crit-ext-type = text

diff --git a/spec/format/cer.texi b/spec/format/cer.texi
index d63ef010a0b0a90d5dce3f8d7c82794f8c34fb99237370ab8b5e1e317df6678a..a34f2442929e7ea40b41bc13dc415bf4324851385e3abdd2c904bfccf68ede3a 100644 (file)
--- a/spec/format/cer.texi
+++ b/spec/format/cer.texi
@@ -41,8 +41,7 @@ identifier, that @strong{should} be generated as an UUIDv4 based on the
 hash of the key.
 
 @item ku
-Intended public key(s) usage. Certificate @strong{must} be signed with
-the certificate having "ca" key usage, unless it is self-signed.
+Intended public key(s) usage.
 Application-specific example with multiple public keys is described
 above. It @strong{must} be absent if empty.