Merge pull request #18 from lamps-wg/seanturner-issue-17

Address #17
lamps-wg · Jul 18, 2024 · f3757b1 · f3757b1
2 parents 61845bc + fff8dd8
commit f3757b1
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/draft-ietf-lamps-dilithium-certificates.xml b/draft-ietf-lamps-dilithium-certificates.xml
@@ -348,9 +348,16 @@ x5AXF2HOm4o=
   keyCertSign; or
   cRLSign.
 ]]></artwork>
-        <t>Requirements about the keyUsage extension bits defined in <xref target="RFC5280" format="default"/> still apply.</t>
-        </section> <!-- End of Key Usage Bits -->
-
+	<t>If the keyUsage extension is present in a certificate that indicates id-ML-DSA in the SubjectPublicKeyInfo, then the following <bcp14>MUST NOT</bcp14> be present:</t>
+<artwork><![CDATA[
+   keyEncipherment; or
+   dataEncipherment; or
+   keyAgreement; or
+   encipherOnly; or
+   decipherOnly.
+]]></artwork>
+	<t>Requirements about the keyUsage extension bits defined in <xref target="RFC5280" format="default"/> still apply.</t>
+        </section>
         <section numbered="true" toc="default">
         <name>ML-DSA Private Keys</name>
         <aside>