Drop encipherment key usages from Gem::Security.create_cert defaults

keyEncipherment should be set only when the subject public key is used
for key transport, and dataEncipherment only when it is used to
directly encrypt user data. RubyGems uses the key for neither purpose.

These key usages are also not applicable to non-RSA keys. In
preparation for ML-DSA support, remove them from the default settings.

Author: rhenium

lib/rubygems/security.rb

@@ -387,14 +387,12 @@ class Exception < Gem::Exception; end
   # The default set of extensions are:
   #
   # * The certificate is not a certificate authority
-  # * The key for the certificate may be used for key and data encipherment
-  #   and digital signatures
+  # * The key for the certificate may be used for digital signatures
   # * The certificate contains a subject key identifier
 
   EXTENSIONS = {
     "basicConstraints" => "CA:FALSE",
-    "keyUsage" =>
-      "keyEncipherment,dataEncipherment,digitalSignature",
+    "keyUsage" => "digitalSignature",
     "subjectKeyIdentifier" => "hash",
   }.freeze
 

test/rubygems/test_gem_security.rb

@@ -34,8 +34,7 @@ def test_class_create_cert
     assert_equal "CA:FALSE", constraints.value
 
     key_usage = cert.extensions.find {|ext| ext.oid == "keyUsage" }
-    assert_equal "Digital Signature, Key Encipherment, Data Encipherment",
-                 key_usage.value
+    assert_include key_usage.value, "Digital Signature"
 
     key_ident = cert.extensions.find {|ext| ext.oid == "subjectKeyIdentifier" }
     assert_equal 59, key_ident.value.length
@@ -80,8 +79,7 @@ def test_class_create_cert_email
     assert_equal "CA:FALSE", constraints.value
 
     key_usage = cert.extensions.find {|ext| ext.oid == "keyUsage" }
-    assert_equal "Digital Signature, Key Encipherment, Data Encipherment",
-                 key_usage.value
+    assert_include key_usage.value, "Digital Signature"
 
     key_ident = cert.extensions.find {|ext| ext.oid == "subjectKeyIdentifier" }
     assert_equal 59, key_ident.value.length
@@ -312,8 +310,7 @@ def test_class_sign_AltName
     assert_equal "CA:FALSE", constraints.value
 
     key_usage = signed.extensions.find {|ext| ext.oid == "keyUsage" }
-    assert_equal "Digital Signature, Key Encipherment, Data Encipherment",
-                 key_usage.value
+    assert_include key_usage.value, "Digital Signature"
 
     key_ident =
       signed.extensions.find {|ext| ext.oid == "subjectKeyIdentifier" }
@@ -490,8 +487,7 @@ def assert_sign(signing_cert, signing_key)
     assert_equal "CA:FALSE", constraints.value
 
     key_usage = signed.extensions.find {|ext| ext.oid == "keyUsage" }
-    assert_equal "Digital Signature, Key Encipherment, Data Encipherment",
-                 key_usage.value
+    assert_include key_usage.value, "Digital Signature"
 
     key_ident =
       signed.extensions.find {|ext| ext.oid == "subjectKeyIdentifier" }