Subject: RE: TSP: Response to the comments raised by Russ Housley

From: [email-masked]
Date: Tue, 10 Oct 2000 10:36:36 -0400

Russ,

What don't you like in policy qualifiers?

I still think it would be useful to have the option to include a link to the
practice statement of the TSA within each time stamping response. Although I
understand that no automated processing is currently done today with these
practice statements, once they are written in XML, maybe relying parties
could then start to do something with them. However, with no optional
pointer to the TSA practice statement, it will never be possible.

Regards,

Francois

>Russ,
>
> Thank you for your response.
>
> The only remaining issues are numbered 3 and 10. See my comments
> embedded below.
> 
>> Denis:
>> 
[snip]
>> 
>> 3. I am not satisfied.  I accept that this is not the place to define
>> TSP policy or practice statements.  However, I do not think that the RFC
>> 2459 syntax is appropriate for use in the TSP context.  Also, you ignored
>> my concern regarding qualifiers.  RFC 2459 contains:
>> 
>>     PolicyInformation ::= SEQUENCE {
>>          policyIdentifier   CertPolicyId,
>>          policyQualifiers   SEQUENCE SIZE (1..MAX) OF
>>                                  PolicyQualifierInfo OPTIONAL }
>> 
>> I would prefer a structure that said "TSAPolicyId" instead of
>> "CertPolicyId." Using "CertPolicyId" in this context will, in my
>> opinion, confuse matters.  Also, I would like to omit policy qualifiers
>> altogether.  I do not like them in certificate policies, and I would
>> like to avoid them in TSA policies.
>
> I had corrected the text but I did not understood your were also
> requesting an ASN.1 change.
> Sorry about that misunderstanding. I agree with your request and I have
> done the changes, i.e:
>
> TSAPolicyId ::= OBJECT IDENTIFIER
>
> and in the request:
>
> reqPolicy       TSAPolicyId    OPTIONAL,
>
> while in the response:
>
> policy          TSAPolicyId,
>
[snip]

---

From: Michael Zolotarev <[email-masked]>
Date: Wed, 11 Oct 2000 12:57:14 +1000

Francois,
I tend to agree with Ross, favoring using just a policy OID. 
 
The reasoning is that a diligent client - since only 'diligent' clients
would be ever interested in reading practice statements - would have to read
the statement before(!) making the very first transaction. So the
information should be available prior to obtaining a timestamp.
 
Anticipating your argument - no, there are better ways of finding references
to the TSA practice statement than executing a 'void' transaction to get the
reference from a timestamp. The SubjectInformationAccess extension in the
TSA cert is a possible one, in addition to other less sophisticated ones.
 
regards
Michael

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, 11 October 2000 0:37
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: TSP: Response to the comments raised by Russ Housley

Russ, 

Regards, 

Francois 

[snip] 

[snip]

---

From: Russ Housley <[email-masked]>
Date: Wed, 11 Oct 2000 13:44:10 -0400

Francois:

Policy qualifiers can lead to huge interoperability problems.  I am
less concerned about URLs that point to CP or CPS documents than other
uses.  In RFC 2459, I wanted to prohibit policy qualifiers all
together to avoid the interoperability issues.  The limited support
for policy qualifiers is the compromise.

Russ

At 10:36 AM 10/10/2000 -0400, [email-masked] wrote:

Russ,

I still think it would be useful to have the option to
include a link to the practice statement of the TSA within each time
stamping response. Although I understand that no automated processing is
currently done today with these practice statements, once they are
written in XML, maybe relying parties could then start to do something
with them. However, with no optional pointer to the TSA practice
statement, it will never be possible.

Regards,

Francois

[snip]

>> "CertPolicyId." Using
"CertPolicyId" in this context will, in my

policy
TSAPolicyId,

[snip]