RE: Recommendation on subject matching rules needed..

["Vainikainen Saku EINT" <Saku.Vainikainen@xxxxxxxx>]

> > Allow decrypt
> > 
> > 1) if Subject Key Identifiers match
> > 2) if Subject Unique Identifiers match
> > 3) if Subjects + Subject Alt. Names match
> > 4) if Issuer Key Identifiers match
> > 5) if Issuer Unique Identifiers match
> > 6) if Issuers match
> 
> Shouldn't just being in possession of the private key be enough to 
> decrypt previously encrypted data. (what is a certificate 
> needed for in this use case? )
> 
> I can think of a minor reason to have a certificate: to locate the 
> key pair by searching for subject and key usage - however, 
> that should not be the only way by which a software can 
> locate the right key to use, or?

I suppose if the cert is not used to locate the key, then the only way
to find out which key to use would be to decrypt with all available keys
and try to make sense of the decrypted data to figure out which key was
the proper one..

Anyways at least the email clients want to check the e-mail address in
the cert as well as issuer+serno or do some form of binary match on the
certs.

Saku.