Subject: Re: Getting CA capabilities

From: [email-masked]
Date: Wed, 12 Apr 2000 15:01:03 -0400

Actually, there's one more reason I can think of.  A CA's software can
be upgraded between versions, adding new capabilities (perhaps support for
a new digest algorithm) and its certificate would not usually change.  So
for a variety of reasons, a messaging interface is better than a
certificate for capabilities.  If a non-messaging interface were used,
something that might work would be an AIA value pointing at the URI where
capabilities could be downloaded or checked.
     However, for extensibility reasons, the list of capabilities returned
should probably be a set or sequence of object ID's rather than a bit
string.
     On your other issue, since HMAC-SHA1 is already mandatory to implement
in RFC 2510 and is the only MAC algorithm which is, why rule out the use by
bilateral agreement of other algorithms?  In practice, will clients which
are intended to be used with multiple vendors' server dare to use anything
else by default?

          Tom Gindin