Subject: SCVP & validation policies

From: Stephen Kent <[email-masked]>
Date: Thu, 6 May 2004 10:44:42 -0400

Trevor,

I have to agree with Denis, in that it was my impression that the 
client would pass an OID to the server to express the validation 
policy to be used. The servers will, in many cases, be local to an 
enterprise, and thus it is very feasible to use a single OID to 
reference a policy that bundles all the parameters together.  In 
fact, I am not even sure that a public SCVP server is better off with 
an ala carte approach to policy specification, but I might be able to 
be convinced.

Steve

---

From: "Wen-Cheng Wang" <[email-masked]>
Date: Fri, 7 May 2004 14:47:26 +0800

I think we should write down the possible scenarios of
the DPVclient-server interactions, or the debate will be
endless. The following  are four possible scenarios.
Part of them are concluded from the recent SCVP
discussion thread, while some of them are my own
opinions. Please make your comments and add you
own scenarios. I hope the discussion on the the
possible scenarios can help the WG to reach
consensus. I also hope that the SCVP draft can
add a section to reveal the the possible scenarios
after we reach consensus.

Scenario 1 (single central-managed vlidation policy)

  DPV server:
      only supports a single central-managed vlidation policy
      the validation policy implies all policy-dependent parameters

  DPV client:
      the validation request may optionally specify the vlidation policy OID
      the validation request needs not specify any policy-dependent
          parameters

Scenario 2 (multiple central-managed vlidation policies)

  DPV server:
      supports multiple central-managed vlidation policies
      each validation policy implies its policy-dependent parameters

  DPV client:
      the validation request need to specify the vlidation policy OID
      the validation request needs not to specify any policy-dependent
          parameters

Scenario 3 (multiple central-managed vlidation policies with a default
validation policy)

  DPV server:
      supports multiple central-managed vlidation policies with one of them
          is the default
      each validation policy implies its policy-dependent parameters

  DPV client:
      the validation request should specify the vlidation policy OID
      if the request did not specify the vlidation policy OID, then the
         server will use the default one
      the validation request needs not to specify any policy-dependent
         parameters

Scenario 4 (no central-managed vlidation policy)
  DPV server:
      with no predefined vlidation policy
      will let client side to decide how it want the server to run the path
          validation algorithm
      (Note: It is "validation algorithm" not "validation policy", since
       there is no predefined validation policy.)

  DPV client:
      the validation request should specify all initial parameters for the
         the path validation algorithm
      (Note again: It is "validation algorithm" not "validation policy",
since
        there is no predefined validation policy.)

Scenario 1, 2, and 3 are mostly occures when a DPV server is used
as an authority to centrally manage validation policies. (E.g., in an
enterprise). Scenario 4 will be the case where a DPV server is used
as a public server. (E.g., a commercial path validation service)
I believe that if a DPV server is to be used as a public server, then
there will be no any predefined validation policy between the client
and the server. Therefore, it make no sense to ask a client to specify
a validation policy OID in the request to a public DPV server. Instead,
the DPV protocol should design a mechainsm that allows the client
to specify all initial parameters for the the path validation algorithm.
In SCVP, such mechanism could be a "extension" that allows clients
to specify all initial parameters of RFC 3280 path validation algorithm.
The use of validation policy OID and validation algorithm parameters
extension is usually orthogonal. If validation policy OID is used, then
it usually means that validation algorithm parameters are implied by
the validation policy OID and therefore there is not need for the client
to specify validation algorithm parameters. On the other hand, if
validation algorithm parameters extension is used, it usually means
there is no predefined validation policy (i.e., the DPV server is a public
server) for the client to specify in its request.

Wen-Cheng Wang