AI 272: KeyDescriptor errata

["Scott Cantor" <cantor.2@osu.edu>]

Description:

The Metadata specification is underspecified with regard to how to interpret
the KeyDescriptor element's "use" attribute and how TLS keys are expressed.

Proposal:

Insert text after line 624 of Metadata:

A use value of "signing" means that the contained key information is
applicable to both signing and TLS/SSL operations performed by the entity
when acting in the enclosing role.

A use value of "encryption" means that the contained key information is
suitable for use in wrapping encryption keys for use by the entity when
acting in the enclosing role.

If the use attribute is omitted, then the contained key information is
applicable to both of the above uses.

Comments:

If "wrapping encryption keys" isn't a precise enough term, please find some
crypto experts to clarify it...

It's worth noting to the TC that this doesn't even scratch the surface of
the problems with KeyInfo interop, and spec and product users are starting
to notice...

-- Scott