Re: PublicKeyFile Format Security Considerations

[Bill Sommerfeld <sommerfeld%east.sun.com@localhost>]

>   The file format described by this document provides no mechanism
>   to verify the integrity or otherwise detect tampering of the
>   data stored in such files. It is the responsibility of the parties
>   that create or exchange files written in this format to ensure that 
>   appropriate access controls are applied to such files, and that 
>   the files, if transfered, are exchanged over a trusted channel.
> 
>   The data encoded using this file format is sensitive. 

"sensitive" in what sense?  

>   Implementors are cautioned to verify the correctness of the
>   encoding/decoding routines used to save and read files in this
>   format. A malfunctioning decoder used to read a public-key file
>   will most likely produce unsound data of unknown cryptographic
>   properties that in the worst case could be vulnerable various
>   forms of cryptographic attack.

					- Bill