This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
Presently, the RSASSA-PKCS1-v1_5 and RSAES-PKCS1-v1_5 algorithms each have a generateKey operation. However, the intended operation is not a property of an RSA key: we have defined the keyUsages field to constrain the uses of a key. Consider removing generateKey from RSASSA-PKCS1-v1_5 and RSAES-PKCS1-v1_5 and defining a new algorithm, "RSA-PKCS1-v1_5", with generateKey, importKey and exportKey operations.
This is a design choice, not a defect. The re-use of an AES key in multiple modes of operation can be fatal to the underlying security guarantees. A key used to protect or unprotect data with a particular algorithm should not be reused for any other algorithms. This was previously discussed on several conference calls and on the mailing list with the explanation as such: If the intended use of an RSA key (or any algorithm key) is to use with a specific algorithm, such as RSASSA-PKCS#1v1.5 or RSA-OAEP, then before any key is generated (which may drain entropy, result in user interaction, or otherwise consume computational resources), then the implementation should check that the operation will be able to be performed. In short, all keys generated or imported are tagged with the algorithm that they are intended to be used for. This also avoids the key reuse issue, described above.