Extra byte in Key Usage value

[jasontwong]

When using rcgen version 0.13.1 BIT STRING value for Digital Signature is 0x80

Newer versions I get 0x80 0x00 as the value.

[djc]

Maybe try to bisect this with git to find the offending commit?

You haven't really made an argument on whether the new behavior is wrong.

[jasontwong]

Sorry, I'm not sure where the "source of truth" should be for this. But I'm trying to do path validation in elixir using :public_key.pkix_path_validation. When I generate two signed certs with the same CA, the ones with the additional byte fail and others succeed.

[jasontwong]

Doing more research I found the following excerpt:

10 Distinguished encoding rules The encoding of a data values employed by the distinguished encoding rules is the basic encoding described in clause 8, together with the following restrictions and those also listed in clause 11.

10.1 Length forms The definite form of length encoding shall be used, encoded in the minimum number of octets. [Contrast with 8.1.3.2 b).]

which was sourced from: https://www.itu.int/rec/T-REC-X.690

[ctz]

I think 3c23da7 is incorrect; KEY_USAGE_BITS should be something like u16::BITS - bit_string.trailing_zeros() or something?

[lvkv]

Yeah, I think the comment (and corresponding block of code) I made over at #287 (comment) didn't consider the "minimum number of octets" bit. Thanks for catching!