Daniel Brown <dbrown(_at_)certicom(_dot_)com> writes:
This is a serious problem, imo. If Bob receives an AuthenticatedData from
Alice but it is not really from Alice, then there really is no
authentication, despite the promise that AuthenticatedData provides
authentication. What security service is AuthenticatedData providing in this
case?
Maybe it would have been better to call it IntegrityProtectedData :-). That's
actually the only thing I've ever used it for, my assumption was that you sign
email and you MAC stored data.
Peter.