Bob Jueneman wrote:
Now if we can just get rid of all of the in-band certificates!
You can assuming the CA complies and includes extensions in their end
user certificates. Check out the authorityInfoAccess attribute in the
PKIX certificate and CRL spec.
Maybe it should be at least mentioned in CMS with the addition that it
MUST be an authenticated attribute.
Steve.
--
Dr Stephen N. Henson.
UK based freelance Cryptographic Consultant. For info see homepage.
Homepage: http://www.drh-consultancy.demon.co.uk/
Email: shenson(_at_)bigfoot(_dot_)com
PGP key: via homepage.