Study. uk . com
  1. Home
  2. All questions
  3. Question 242

CISSP study material · question 242 of 500

A certificate is issued with a keyUsage extension present but every bit left unset. Why does RFC 5280 treat this as invalid?

  1. The extension may only appear on certificate authority certificates.
  2. Where the keyUsage extension appears, at least one bit must be set to one.
  3. The extension must always be marked critical, and an empty value cannot be critical.
  4. An empty keyUsage is read as permitting every usage, which the profile forbids.
Show the answer

Answer: B. Where the keyUsage extension appears, at least one bit must be set to one.

RFC 5280 requires at least one bit to be set wherever the extension appears; a bit string with none set is not permitted.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.3 Key Usage

Challenge yourself on this topic → Study as cards