Study. uk . com
  1. Home
  2. All questions
  3. Question 245

CISSP study material · question 245 of 500

A certificate profile mandates the nonRepudiation bit and a reviewer notes recent editions of X.509 use a different name for it. What is the bit now called, and what does it cover?

  1. contentCommitment, covering signatures intended to stop a signer later denying the act.
  2. digitalSignature, covering all signature verification uses.
  3. cRLSign, covering signatures over revocation lists.
  4. keyCertSign, covering signatures over other certificates.
Show the answer

Answer: A. contentCommitment, covering signatures intended to stop a signer later denying the act.

RFC 5280 notes recent X.509 editions renamed nonRepudiation to contentCommitment; the bit covers signatures providing a non-repudiation service against the signer later denying an action.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.3 Key Usage

Challenge yourself on this topic → Study as cards