John Lowry writes:
AttributeCertificates as proposed by X9.30 in fact do NOT contain
the holder's DN but a pointer (consisting of issuer DN, UID etc.)
to the holder's key certificate. (Note that one needs to use a
DN to lookup and validate the AttributeCertificate issuer as well)
FYI, we have discussed this at this week's X9F1 meeting, and concluded
that in some cases an attribute should be linked to a key certificate
and in some cases to a DN. Hence, X9.30 has been modified to allow a
choice of DN or {issuer name plus cert. serial no.} as the link.
Warwick