Subject: RE: FW: scvp

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 6 May 2004 10:22:37 -0700

If we want to go down the route of providing a shorthand notation for a
validation policy, using an OID just opens up ambiguity. We are assuming
both client and server have a common understating of both - which add
additional management overhead. It seems like yesterday we had the
discussion on whether a certificate policy should also have a hash so
the RP could tell if the policy had changed. If we truly want a
shorthand notation to a policy then using a hash over the set of input
parameters provides an unambiguous statement of what is required.
Trevor

-----Original Message-----
From: Peter Sylvester [mailto:[email-masked]] 
Sent: Thursday, May 06, 2004 9:25 AM
To: Trevor Freeman; [email-masked]
Cc: [email-masked]
Subject: Re: FW: scvp

I agree with Denis about a single value policy.

I think that we have already a structure elsewhere that
is close to what can be used.  

   PolicyInformation ::= SEQUENCE {
        policyIdentifier   CertPolicyId,
        policyQualifiers   SEQUENCE SIZE (1..MAX) OF
                                PolicyQualifierInfo OPTIONAL }

   CertPolicyId ::= OBJECT IDENTIFIER

   PolicyQualifierInfo ::= SEQUENCE {
        policyQualifierId  PolicyQualifierId,
        qualifier          ANY DEFINED BY policyQualifierId }

the PolicyQualifierId would be an indidation of a
particular algorithm that needs to be performed and its
parameters. one would be "3280 path processing input"
another would be 'end entry naming comparison', etc.