Subject: Questions about the samples in Part1-11

From: Marc Branchaud <[email-masked]>
Date: Thu, 05 Nov 1998 10:44:05 -0800

-----BEGIN PGP SIGNED MESSAGE-----

Content-Type: text/plain; charset=us-ascii

Hi all...

Not to detract from the terrific debate over fundamental PKI architectures,
but I have a couple of questions/comments about the annotated sample certs
in the Part1 draft.  These concern the AuthorityKeyIdentifier extension.

In the cert in D.2, the OID for the authKeyId (2.5.29.35) is mislabeled as
subjectAltName.

In the cert in D.3, the OID is properly labeled, but the key identifier 
itself is 16 bytes long.  16 bytes doesn't correspond to either of the key 
identifier possibilities (the 160-bit SHA1 hash or the 64-bit partial-
hash-and-prefix).

I'm guessing that the mislabeled authKeyId in the D.2 cert is correct, and
that the properly labeled one in D.3 has got a bad value.

(The subjectKeyId in D.1 looks OK to me.)

Am I misinterpreting this stuff?

		Marc