Re: Who generates AOCE keys?

[collins@newton.apple.com (Scott Collins)]

Christian D. Odhner writes:

  >what keeps people from [getting certified] keys with somebody else's name

The The relation between the preferred signature authority for the
installation, and that installation.  From the documentation:

  >Some companies authorized to issue approval files to their employees may
  >require that you sign a printed request form and have it notarized by a
  >notary public. (To create a printed request form, choose Print from the File
  >menu.)  Note:  If you are going to use your Signer as an individual or in a
  >small business, look for the insert that came with this package for
  >instructions on using an outside approval authority. 

  >Print your request and send it, with a copy of the Request file on disk if
  >necessary, to your approval authority.  See the insert that came with your
  >package for details.  Assuming that your request form has been completed
  >properly, the approval authority will send back your Signer Approval file.


...which would seem to put the lie to (the general application of) my
ealier statement:

  >[the key] can be mailed automagically to RSADSI


Which turns out to be true only for the 'low assurance' RSA Persona
Certificate Authority (currently handing out certificates for free) which
does no verification of the user<-->id link.  CAs with more stringent
policies have stronger prerequisites for the issuance of a certificate.

Hope this helps,


Scott Collins         | "Few people realize what tremendous power there
                      |  is in one of these things."     -- Willy Wonka
......................|................................................
BUSINESS.   voice:408.862.0540  fax:974.6094   collins@newton.apple.com
Apple Computer, Inc.   1 Infinite Loop, MS 301-2C   Cupertino, CA 95014
.......................................................................
PERSONAL.   voice/fax:408.257.1746    1024:669687   catalyst@netcom.com