Subject: Should PDP Be a Separate Specification??

From: "Yuriy Dzambasow" <[email-masked]>
Date: Fri, 1 Mar 2002 11:39:24 -0500

It seems to me that it would be more beneficial to have a separate
requirements document for the Policy Definition Protocol (PDP) defined in
the DPD/DPV requirements document, than to integrate into the DPD/DPV
document (which also attempts to address DSV policy requirements).  The
benefits of having a separate PDP requirements document are:

- it focuses solely on policy definition to support protocols such as
DPD/DPV/DSV;
- the DPD/DPV/DSV specification can simply reference PDP as needed
- change control on the specifications are simplified (i.e., PDP changes
don't necessarily force changes to DPD/DPV/DSV)

I'd like to hear thoughts from others on this.

Yuriy

---

From: Petra Barzin <[email-masked]>
Date: Sun, 03 Mar 2002 21:11:30 +0100

Yes, I agree. It should be a separate document!

- Petra

---

From: "todd glassey" <[email-masked]>
Date: Sun, 3 Mar 2002 15:39:29 -0800

Petra and Yuri -
Its not so much a Policy Definition Protocol, but a negotiation protocol.
What needs to happen is that some specific POLICY MODELS have to be built
(Stephen notice the Upper Case wording for emphasis :-), and these policy
models need a set of real world event types. From there you can actually
create a protocol that can be used to say:

"hey other end - this is what I have and here is how I want to do it. Can
you accommodate this "event type" and if so under what circumstances?" and
the response from the other end is  either a yes or a no and the terms and
conditions that it will accept or proffer.

This type of automated process wherein the application can negotiate and
make acceptance decisions is exactly what is missing from the PKI
infrastructure of PKIX today. That and the data structure standards, i.e.
the TST's and the like.

This is why timestamping and policy control and communication are so
important and obviously tied directly to each other at the use level.

PKIX's problem is clearly that the tools that it is proffering are not meant
to be used when Humans are not present and that is in my mind a clear error.
The whole point of overlaying human trust processes on top of machines is to
allow us to not have to be involved i the middle of the process.

Todd

---

From: "Yuriy Dzambasow" <[email-masked]>
Date: Mon, 4 Mar 2002 10:34:03 -0500

Todd,

I think both DEFINITION and NEGOTIATION could be supported by the same
protocol.  DEFINITION can be used by security managers to define a policy at
a server.  NEGOTIATION can be used between clients and servers to negotiate
a policy that is acceptable to support operations like DPD and DPV.

Yuriy

-----Original Message-----
From: todd glassey [mailto:[email-masked]]
Sent: Sunday, March 03, 2002 6:39 PM
To: Petra Barzin; [email-masked]
Cc: PKIX
Subject: Re: Should PDP Be a Separate Specification??

Petra and Yuri -

Todd