Re: Recommendation on subject matching rules needed..

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"Vainikainen Saku EINT" <Saku.Vainikainen@xxxxxxxx> writes:

>It seems that all the software we have tested (eg. MSoft, Utimaco)

Everyone, not just those two.

>tend to do somekind of binary comparison (hash values I suppose) 

issuerAndSerialNumber.

>The only problem is that the encryption key pair may have been
>recertified in between.

Therein lies the problem: Don't issue multiple certificates for the
same key.  If you "recover the archived encryption keypair" why not
recover the cert that goes with it?

(NB: Saying "We need to be able to issue a new encryption cert because
 we revoke the old one" isn't valid because the private key is still in
 use, so revoking the old cert is pointless).

Peter.