From e0bdf02af721d15e3835e192e65d131bb0427ab6 Mon Sep 17 00:00:00 2001
From: Sean Turner <sean@sn3rd.com>
Date: Tue, 9 Jul 2024 09:37:37 -0400
Subject: [PATCH] Address #17

Addresses #17.
---
 draft-ietf-lamps-dilithium-certificates.xml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/draft-ietf-lamps-dilithium-certificates.xml b/draft-ietf-lamps-dilithium-certificates.xml
index ac7eb5f..fdd55be 100644
--- a/draft-ietf-lamps-dilithium-certificates.xml
+++ b/draft-ietf-lamps-dilithium-certificates.xml
@@ -274,7 +274,15 @@ x5AXF2HOm4o=
   keyCertSign; or
   cRLSign.
 ]]></artwork>
-         <t>Requirements about the keyUsage extension bits defined in <xref target="RFC5280" format="default"/> still apply.</t>
+	<t>If the keyUsage extension is present in a certificate that indicates id-ML-DSA in the SubjectPublicKeyInfo, then the following <bcp14>MUST NOT</bcp14> be present:</t>
+<artwork><![CDATA[
+   keyEncipherment; or
+   dataEncipherment; or
+   keyAgreement; or
+   encipherOnly; or
+   decipherOnly.
+]]></artwork>
+	<t>Requirements about the keyUsage extension bits defined in <xref target="RFC5280" format="default"/> still apply.</t>
         </section>
 
         <section numbered="true" toc="default">