Subject: Re: I-D ACTION:draft-ietf-pkix-ocsp-valid-00.txt

From: Denis Pinkas <[email-masked]>
Date: Wed, 04 Oct 2000 12:04:15 +0200

Comments on the document on Delegated path validation

The validation has to be made against a set of rules which may be more
complex than validation against a single root key associated with
Certificate policy constraints and naming constraints. These constraints are
not necessarily embedded in a self-signed certificate. Multiple root keys
may be used in parallel. In addition, it may be important to use either CRLs
or ARLs only, or OCSP responses. This may even be different whether it is
for a leaf certificate or a CA certificate.

This set of rules may be called "validation policy" and is thus fully
distinct from a Certificate Policy (CP). The protocol should support as an
option the possibility to simply provide a single OID which will be the OID
of the validation policy.

As an alternative, when the rules are "simpler", it could be possible to
support a set of trust points with their constraints. 

For all these trust points, it should be possible to specify whether CRLs or
OCSP responses should be used for leaf certificates and whether ARLs or OCSP
responses should be used for CA certificates.

For every trust point, it should be possible to specify the self-signed
certificate and, if the Certificate Policy constraints and the naming
constrains are not included in it, to specify them separately.

The structure of both the request and the response should be modified to
accommodate these requirements.

Denis