Re: [IETF-PKIX] CMP draft question

[Carlisle Adams <[e-mail]>]

Hi Gina,

>----------
>From:  [e-mail][SMTP:[e-mail]]
>Sent:  Tuesday, February 10, 1998 2:23 PM
>To:    Carlisle Adams; [e-mail]
>Subject:       CMP draft question
>
>       Hi!
>
>       I have a question about the root CA fingerprint mentioned in
>the CMP draft-ietf-pkix-ipki3cmp-06.txt. I was wondering if someone
>could please clarify the procedure in section 4.1.  In particular,
>in the second paragraph, I find the use of the terms "this information"
>and "this value" unclear when several values are referred to in the section.

Is the following clearer?

"In  order to make the CA's self certificate useful to end entities that
do not acquire the self certificate via "out-of-band" means, the CA
must also produce a fingerprint for its public key.  End entities that
acquire this fingerprint securely via some "out-of-band" means can then
verify the CA's self-certificate and hence the other attributes
contained therein."


>Also, how does the fingerprint allow an end entity to securely use the CAs
>self-certificate, as mentioned in section 4.7.2?

In order to trust the CA's public key, I either need a trusted copy of
the key itself or I need a trusted fingerprint of the key.  If I have
the latter I can verify the self-signed certificate (which I may have
acquired by any untrusted means) because I can compute the fingerprint
of the key in the certificate, compare it with the fingerprint that I
have, and (if they are equal) use the key to verify the certificate.

Carlisle.