proposal: crypto/x509: support for RFC 9336 Document Signing EKU

[elear]

Proposal Details

RFC 9336 specifies a new EKU for document signing, allowing for a separate and distinct EKU from either code signing or smime email signing. That document explains the reason for the new EKU.

Form a golang perspective, this requires entries in three tables in src/crypto/x509/x509.go for id-kp-documentSigning, or OID 1.3.6.1.5.5.7.3.36.

[seankhliao]

I don't think this results in any new external API? but then I also don't see what support means if it's not exposed

[ianlancetaylor]

CC @golang/security

[elear]

@seankhliao Thanks. This is my first issue in golang, so please bear with me. The change is meant to expose a new EKU that would be used as a value in Certificate.ExtKeyUsage in x509. api-test does indeed whine that this is a change and rightly so, since the addition needs to be documented.

[gopherbot]

Change https://go.dev/cl/636195 mentions this issue: crypto/x509: Add support for RFC 9336 (document signing EKU)

[gabyhelp]

Related Code Changes

• crypto/x509: Add support for RFC 9336 (document signing EKU)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[seankhliao]

So the api change is a new constant under https://pkg.go.dev/crypto/x509#ExtKeyUsage

const (
    ...
    ExtKeyUsageDocumentSigning ExtKeyUsage 
)

[elear]

@seankhliao precisely. That's what CL 636195 does.