Subject: CAP (UPN ORGANIZER/ATTENDEE validation) - latest interm draft

From: Doug Royer <[email-masked]>
Date: Tue, 08 Jan 2002 13:53:49 -0700

2.4.1.1 UPNs and Certificates

Near the end it says:

>   Note: If a CS or CUA is validating data received via iMIP, if the
>   "ORGANIZER" or "ATTENDEE" property said (e.g.) "ATTENDEE;CN=Joe
>   Random User:MAILTO:[email-masked]" then the email address should
>   be checked against the UPN.  This is so the "ATTENDEE" property
>   cannot be changed to something misleading like "ATTENDEE;CN=Joe
>   Rictus User:MAILTO:[email-masked]" and have it pass validation.
>   This validation will also defeat other attempts at confusion.

This is confusing to me:

I can get an iMIP message with multiple ATTENDEE entries, or
one, or NONE of them might be me. There is NO requirement
that the iMIP recipient be in the ATTENDEE list or that
it be the ORGANIZER. I could send you an iMIP message informing
you of an event that where I am not the organizer, and you
are not an attendee.

As I understand it, the CS MUST (Per iMIP) compare the ORGANIZER
to the signature, and match that to the FROM line (S/MIME iMIP).
But there is no way to know which ATTENDEE in a multiple ATTENDEE
VEVENT should be compared. And a METHOD:PUBLISH iMIP message
might have NO ATTENDEE properties.

So what is the above Note saying?
What would I compare to what? And when?