All,
I agree with Paul's proposed wording with the following comment:
Please change:
OLD: "If a SignedData object has more than one SignerInfo that has an
mlExpansionHistory attribute, the recipient MUST compare the
mlExpansionHistory attributes in all the SignerInfos, and MUST NOT process
the mlExpansionHistory attribute unless every mlExpansionHistory attribute
in the SignedData block is identical. If the mlExpansionHistory attributes
in the signerInfos are not all identical, then the receiving agent MUST stop
processing the message and SHOULD notify the user or MLA administrator of
this error condition."
NEW: "If a SignedData object has more than one SignerInfo that has an
mlExpansionHistory attribute, the recipient MUST compare the
mlExpansionHistory attributes in all the SignerInfos that it has verified,
and MUST NOT process the mlExpansionHistory attribute unless every verified
mlExpansionHistory attribute in the SignedData block is identical. If the
mlExpansionHistory attributes in the verified signerInfos are not all
identical, then the receiving agent MUST stop processing the message and
SHOULD notify the user or MLA administrator of this error condition."
================================
John Pawling, jsp(_at_)jgvandyke(_dot_)com
J.G. Van Dyke & Associates, Inc.
www.jgvandyke.com
================================