Subject: Re: Q. Automatic certificate selection for signing

From: "Tammy Green" <[email-masked]>
Date: Fri, 17 Jan 2003 11:42:41 -0700

:)  No....  It's just a bad habit I developed from talking to non-pki
folk where absolute precision gets in the way sometimes.  
 
Obviously, I meant that the private key would be used to sign the data.
 The user/software would use the certificate(s) to determine which
certificate-and-private-key set would be used to perform the signature. 
The signature would be created using the private key, but only after the
matching certificate had been checked for validity and to be sure that
it could be used for signatures.  The certificate associated with the
private key would probably be tacked on to the signed data such that the
relying party could validate the signature using the certificate.

>>> Vadim Fedukovich <[email-masked]> 1/17/03 2:05:03 AM >>>

Let me just say I'm impressed we are still talking about "using
certificates
for signing". To sign, the private key is used. At least for pkcs7.
Certificate is used while verification.

did I miss something?

On Thu, Jan 16, 2003 at 05:17:39PM -0700, Tammy Green wrote:
> In trying to design something like this a while back, I found that a
> blanket statement of "use this certificate for application x" was
not
> always sufficient.  Two areas where the concept broke down were: