imported S5.4.3 from John Colosi of Verisign.