Question: In the context of the PKIHeader field for Network Domain Security (NDS) Authentication Framework, what is the requirement for the 'protectionAlg' field of PKIHeader when the 'protection' field of PKIMessage is mandatory?
Option 1: The protectionAlg field is optional but recommended to be of type MSG_ENC_ALG.
Option 2: The protectionAlg field is mandatory and shall be of type MSG_SIG_ALG, based on the algorithm in the SubjectPublicKeyInfo field of the signer’s certificate.
Option 3: The protectionAlg field can be either MSG_SIG_ALG or MSG_ENC_ALG, depending on the base station's configuration.
Option 4: The protectionAlg field is not related to the 'protection' field of PKIMessage and its type is determined by the RA/CA.
Explanation: This is correct because when the 'protection' field of PKIMessage is mandatory, indicating a form of cryptographic protection (in this case, signing) is applied, the 'protectionAlg' field in PKIHeader must specify the algorithm used for this protection. Specifying MSG_SIG_ALG, tied to the signer’s certificate algorithm, ensures consistency in cryptographic practices for secure authentication and integrity verification in telecom networks.