Re: [saag] Another bad day at the hash function factory

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Dr Stephen Henson <shenson@xxxxxxxxxxxxxxxxxxxxxxxxxxx> writes:

>I also notice that the examples don't include the subject public key ID
>extension. If the CA used an appropriate recommended algorithm to generate
>SKID then it could demonstrate that the certificate containing A contained a
>consistent SKID whereas the one containing B did not.

I don't think this'd help, given the wide variety of methods for generating
SKIDs, having one that doesn't match the key wouldn't indicate much unless you
could show that every cert issued by the CA except the one in question had
some deterministic mapping from key -> SKID.

Peter.