2. Protection against an attack where a user requests a certificate
with someone else's public key. The user signs the (name, public
key) combination, proving that the user has the private key and is
not replaying someone else's signature.
At the risk of missing something obvious in an open forum, I do not
understand this.
A user wants a certificate signed. The user constructs a request
message and "signs" this message with the private key corresponding to
the public key in the request message. Whether that public key is in a
"cert-request" field or in a prototype certificate in a "certificate"
field, the threats are the same.
What am I missing?
Jim