Subject: RE: Request change in son-of-rfc2633

From: [email-masked] (Peter Gutmann)
Date: Wed, 29 Oct 2003 17:05:24 +1300

Russ Housley <[email-masked]> writes:

>Further, if there is a collision, an implementation can try the very small
>number of public keys that have the same identifier.

How does it know when to stop looking for more certs?  For example, what if it
can only find one cert and it's the wrong one?

Peter.

---

From: Russ Housley <[email-masked]>
Date: Tue, 28 Oct 2003 23:20:19 -0500

>can only find one cert and it's the wrong one?

If the key identifier is computed from the public key as recommended by RFC 
3280, the odds are quite small.  So, if the first certificate located is 
not the right one, search for another.  If one is not located, then return 
an error.

Russ