Subject: RE: Validation policy in DPV/DPD rqmts

From: "Yuriy Dzambasow" <[email-masked]>
Date: Fri, 1 Mar 2002 10:28:16 -0500

Hi Mike,

Although section 7.1 has defined a bunch of MAYs, it does say this:

"In order to succeed, one valid certification path (i.e., none of the
certificates in the path are expired or revoked) MUST be found between an
end-entity certificate and a trust anchor and all constraints that apply to
the certification path MUST be verified."

I think if you say anything more than this you end up getting into
implementation specific details.

Yuriy

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Michael Myers
Sent: Thursday, February 28, 2002 5:14 PM
To: Housley, Russ
Cc: [email-masked]
Subject: RE: Validation policy in DPV/DPD rqmts

Russ,

Section 7.1 addresses the issues but not in my opinion to useful
degree of clarity.  Additional work in this area might improve
the document.

Mike

Michael Myers
t: +415.819.1362
e: mailto:[email-masked]
w: http://www.traceroutesecurity.com

> -----Original Message-----
> From: Housley, Russ [mailto:[email-masked]]
> Sent: Thursday, February 28, 2002 12:39 PM
> To: Michael Myers
> Cc: [email-masked]
> Subject: RE: Validation policy in DPV/DPD rqmts
>
>
> Mike:
>
> >OK, I get it now.  It's basically a roots issue.
> >
> >Then perhaps the I-D could include some informative text that
> >expands on what a rational validation policy might likely
> >address.
>
> Is this really something that needs to be in the
> requirements document?
>
> Russ
>

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 1 Mar 2002 09:03:53 -0800

> From: Yuriy Dzambasow [mailto:[email-masked]]
>
> Hi Mike,
>
> "In order to succeed, one valid certification path
> (i.e., none of the certificates in the path are
> expired or revoked) MUST be found between an
> end-entity certificate and a trust anchor and all
> constraints that apply to the certification path
> MUST be verified."
>
> I think if you say anything more than this you end up
> getting into implementation specific details.

Yuriy,

Probably so on the policy/operational side. It turns out my real
concern has more to do with establishing a floor on the more
algorithmic aspects of path checking, revocation data
referencing and so forth.  Which, at Russ' invitation, I'm
working on at the moment and will later post to the list a
paragraph of proposed text addressing this issue.

Mike