Challenge

 Challenge ::= SEQUENCE {
                 owf                 AlgorithmIdentifier  OPTIONAL,

                 -- MUST be present in the first Challenge; MAY be omitted in
                 -- any subsequent Challenge in POPODecKeyChallContent (if
                 -- omitted, then the owf used in the immediately preceding
                 -- Challenge is to be used).

                 witness             OCTET STRING,
                 -- the result of applying the one-way function (owf) to a
                 -- randomly-generated INTEGER, A.  [Note that a different
                 -- INTEGER MUST be used for each Challenge.]
                 challenge           OCTET STRING
                 -- the encryption (under the public key for which the cert.
                 -- request is being made) of Rand, where Rand is specified as
                 --   Rand ::= SEQUENCE {
                 --      int      INTEGER,
                 --       - the randomly-generated INTEGER A (above)
                 --      sender   GeneralName
                 --       - the sender's name (as included in PKIHeader)
                 --   }
      }