"Al Arsenault" <aarsenau@xxxxxxx> writes:
Okay, it's only a SHOULD, not a MUST, but the scenario you reference below only comes in to play if I signed the CMS message using my CA cert, not my end-entity cert.
Got an example where this is relevant if the sKID's of two different CA certs
are the same?
My CMS example from earlier used with SCEP.
In any case something like this should never be allowed to happen as a matter of basic protocol design. Creating a "unique" key ID and then specifically telling people they can use non-unique IDs is just asking for trouble.
Peter.