RE: Recommendation on subject matching rules needed..

["Markus Lorch" <mlorch@xxxxxx>]

> Certificate contains enough data to compare the subjects and 
> the keys instead of the certificates. The comparison should - in 
> my opinion - go more or less as follows:
> 
> Allow decrypt
> 
> 1) if Subject Key Identifiers match
> 2) if Subject Unique Identifiers match
> 3) if Subjects + Subject Alt. Names match
> 4) if Issuer Key Identifiers match
> 5) if Issuer Unique Identifiers match
> 6) if Issuers match
> 

Shouldn't just being in possession of the private key be enough to 
decrypt previously encrypted data. (what is a certificate needed
for in this use case? )

I can think of a minor reason to have a certificate: to locate the 
key pair by searching for subject and key usage - however, that should
not
be the only way by which a software can locate the right key to use, or?

Markus

--------------------------------
Markus Lorch

Dept. of Computer Science (0106)
Virginia Tech, Blacksburg, VA 24061

Phone/Fax: (206) 227 0428
http://csgrad.cs.vt.edu/~mlorch