Subject: authenticity of origin in the request

From: "Mohammad Awad" <[email-masked]>
Date: Wed, 14 Aug 2002 11:19:06 +0300

Hallo
If anyone, please have an answer to this question.
I read in RFC2511 that RA can verify that the certificate requestor is the 
one who claims to be, by using a pre-shared key between them.
If that is not applicable, what are other solutions for the issue of 
(authenticity of the origin of request)?

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx

---

From: "Alice Sturgeon" <[email-masked]>
Date: Wed, 14 Aug 2002 08:38:03 -0400

There would be a number of other out-of-band methods to verify the
authenticity of a certificate request.  Some of these relate to prior
authorization from another authority, as in an organizational group policy
authorization, or batch processing methods, wherein the RA sends certificate
requests to a CA based on a database list previously authenticated by a
third party and submitted to the RA, under previously-agreed arrangements
(e.g., contract).  Note that with such methods there is an issue of shift of
liability with respect to verification of, in such cases, authorization of
cert requests.  Also, this only works for known relationships (RA/CA and
authorizing entity).

Alice Sturgeon
Chair
Canadian Advisory Committee - Information Technology Security
ISO/IEC JTC1 SC 27
and
System Policy Architect
SPYRUS

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Mohammad Awad
Sent: August 14, 2002 4:19 AM
To: [email-masked]
Subject: authenticity of origin in the request

Hallo