Subject: Re: I-D ACTION:draft-ietf-pkix-certstore-http-00.txt

From: [email-masked] (Peter Gutmann)
Date: Thu, 22 Nov 2001 19:24:29 +1300 (NZDT)

Michael StrM-vder <[email-masked]> writes:
>Peter Gutmann wrote:
>>   iHash         Search key derived from the certificate's issuer DN as it
>>                 appears in the certificate.
>                  ^^^^^^^^^^^^^^^^^^^^^^^^^^
>Hmm, is that sufficient? I remember me stumbling over the right "order" of SET
>in RDN components and calculating the issuerNameHash in OCSP.

I can't think of what more it should say, you take the exact bit pattern which
appears in the cert and hash it.  The same has been used for years with S/MIME
(well, without the hashing step because arbitrary-length data isn't a problem
there as it is with HTTP GET).

(Maybe there's some problem with OCSP which I wasn't aware of, but unless you
 start messing with the encoded form (so it's no longer "as it appears in the
 certificate") the issue of SET ordering never crops up).

Peter.