Subject: RE: Open Issue in Part1: path length constraints

From: Ambarish Malpani <[email-masked]>
Date: Wed, 07 Mar 2001 08:09:54 -0800

Hi Steve,
    While the term "VA" might not be part of the IETF standards,
it is the entity that can do the following:

a. Sign OCSP responses - where you directly trust the responder
b. Sign Indirect CRLs (I suppose this is a circular argument)!
c. Do the Delegated Path Validation protocol.

Agreed?

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Wednesday, March 07, 2001 7:55 AM
> To: Ambarish Malpani
> Cc: [email-masked]
> Subject: RE: Open Issue in Part1: path length constraints
> 
> 
> Ambarish,
> 
> >Steve, we use the Indirect CRL/Indirect delta CRL format to
> >propogate revocation information for particular CAs between
> >our VAs (Validation Authorities).
> >
> >Basically, as master VA can receive information that a particular
> >cert was revoked at a CA (even if the CA has not had time to
> >issue a new CRL as yet). It can (and does) create a Indirect
> >CRL with this information that it signs. The VA never acts
> >as a CA - it never issues certs, but still needs to be
> >responsible for creating and propogating revocation information
> >to other VAs.
> >
> >While we use these indirect CRLs to propogate information just
> >amongst VAs, it is not a stretch to seeing clients trust these
> >indirect CRLs for their own purposes.
> >
> >Hope this helps justify why it does make sense for non-CAs to
> >still issue CRLs.
> 
> I understand the mechanism you are employing, and I see nothing wrong 
> with it. However, I don't think the notion of a "VA" is part of ITU 
> or IETF standards. Therefore, your use of it in a closed system 
> environment is outside the scope of these standards.
> 
> Steve
>

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 07 Mar 2001 17:34:28 +0100

Ambarish,

> c. Do the Delegated Path Validation protocol.

Certainly not !

This would create a confusion between:

1) a server simply giving the revocation status of a certificate,
2) a server *advertising* revocation for others CAs,
3) a server saying if a certificate is valid according to some policy.

Please use different names!

Denis

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Mar 2001 11:40:33 -0500

Ambarish,

>c. Do the Delegated Path Validation protocol.

Since you made the term up, I suppose a VA can do anything :-).

On a more serious note, we made an explicit provision for non-CA 
signing of OCSP responses when OCSP was created. You are an author, 
so you know this. But, you didn't seem to feel a need to create a 
name for such entities at the time, which is OK too.  CRL signing 
was, prior to v3, strictly the province of a CA. What it seems we 
have in our docs, and to a lesser extent in the X.509 docs, is a 
failure to clearly describe the intent to allow non-CA entities to 
sign CRLs. I say this based on the mix of terms in 2459, and some 
selected examples of text from X.509 that refer to an "authority" 
without naming any sort of authority other than CAs (and AAs?).

So, going forward, if we want to allow non-CAs to perform this 
function, let's just get the text to be clear on this point, and if 
necessary, let's create a name for these entities, to minimize 
confusion.

As for DPV, it is clear that it can be performed by a non-CA entity.

Steve

---

From: "Michael Myers" <[email-masked]>
Date: Wed, 7 Mar 2001 12:40:32 -0800

Steve,

We had in fact worked this very issue both onlist and offlist during the
OCSP drafting stage.  That work led to the consensus view of an OCSP
Authorized Responder as defined by Section 4.2.2.2 of RFC 2560 (cf. my note
the list on 06 March).  So it seems we already have a consensus-based notion
of what to call a non-CA OCSP entity--at least from a standards perspective.

Just trying to save the WG some cycles.

Mike

> Sent: Wednesday, March 07, 2001 8:41 AM
> To: Ambarish Malpani
> Cc: [email-masked]

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Mar 2001 16:40:32 -0500

Mike,

>Just trying to save the WG some cycles.

Thanks,

Steve