Study. uk . com
  1. Home
  2. All questions
  3. Question 246

CISSP study material · question 246 of 500

A certificate sets encipherOnly but leaves keyAgreement unset. How should a relying party interpret the encipherOnly bit?

  1. It restricts the key to encryption for all purposes.
  2. Its meaning is undefined in the absence of keyAgreement.
  3. It is equivalent to setting dataEncipherment.
  4. It invalidates the certificate entirely.
Show the answer

Answer: B. Its meaning is undefined in the absence of keyAgreement.

RFC 5280 states the meaning of encipherOnly, like decipherOnly, is undefined without the keyAgreement bit; together they narrow the key to one direction during key agreement.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.3 Key Usage

Challenge yourself on this topic → Study as cards