Re: Who generates AOCE keys?

Christian D. Odhner writes:

  >what keeps people from [getting certified] keys with somebody else's name

The The relation between the preferred signature authority for the
installation, and that installation.  From the documentation:

  >Some companies authorized to issue approval files to their employees may
  >require that you sign a printed request form and have it notarized by a
  >notary public. (To create a printed request form, choose Print from the File
  >menu.)  Note:  If you are going to use your Signer as an individual or in a
  >small business, look for the insert that came with this package for
  >instructions on using an outside approval authority. 

  >Print your request and send it, with a copy of the Request file on disk if
  >necessary, to your approval authority.  See the insert that came with your
  >package for details.  Assuming that your request form has been completed
  >properly, the approval authority will send back your Signer Approval file.


...which would seem to put the lie to (the general application of) my
ealier statement:

  >[the key] can be mailed automagically to RSADSI


Which turns out to be true only for the 'low assurance' RSA Persona
Certificate Authority (currently handing out certificates for free) which
does no verification of the user<-->id link.  CAs with more stringent
policies have stronger prerequisites for the issuance of a certificate.

Hope this helps,


Scott Collins         | "Few people realize what tremendous power there
                      |  is in one of these things."     -- Willy Wonka
......................|................................................
BUSINESS.   voice:408.862.0540  fax:974.6094   collins@newton.apple.com
Apple Computer, Inc.   1 Infinite Loop, MS 301-2C   Cupertino, CA 95014
.......................................................................
PERSONAL.   voice/fax:408.257.1746    1024:669687   catalyst@netcom.com

> Christian D. Odhner writes:
> 
>   >what keeps people from [getting certified] keys with somebody else's name
> 
> The The relation between the preferred signature authority for the
> installation, and that installation.  From the documentation:
> 
[good stuff from docs deleted]
> 
> Hope this helps,
> 
> 
> Scott Collins         

Oh, ok :> I realy get it now! Thanks. Sorry about the previous post,
everybody...

______________________________________________________________________________
Christian Douglas Odhner     | "The NSA can have my secret key when they pry
cdodhner@indirect.com	     | it from my cold, dead, hands... But they shall
pgp 2.3 public key by finger | NEVER have the password it's encrypted with!"
  "If guns are outlawed, only the government will have guns." -E. Abbey
My opinions are shareware. For a registered copy, send me 15$ in DigiCash.
  Key fingerprint =  58 62 A2 84 FD 4F 56 38  82 69 6F 08 E4 F1 79 11 
------------------------------------------------------------------------------