RE: Embedded certificate image

["Santosh Chokhani" <SChokhani@xxxxxxxxxxxx>]

Tim,

RFC says "The relationship between the subject organization and the
subject
   organization logotype, and the relationship between the issuer and
   either the issuer organization logotype or the community logotype,
   are relationships asserted by the issuer."

It tends to imply that the logotype is predefined data and not in the
certificate request payload.

> -----Original Message-----
> From: Timothy J. Miller [mailto:tmiller@xxxxxxxxx] 
> Sent: Thursday, July 30, 2009 5:03 PM
> To: Santosh Chokhani
> Cc: Stefan Santesson; ietf-pkix
> Subject: Re: Embedded certificate image
> 
> Santosh Chokhani wrote:
> 
> > Stefan is saying that the data is not applicant chosen. 
> 
> The subject org logotype in 3709 is applicant chosen and has 
> the same problem.
> 
> I think the countermeasure of re-ordering extensions is 
> sufficient, and is probably worth a security consideration in 
> both specs.
> 
> -- Tim
>