Subject: RE: Need for an XML based cert check protocol with RPP capability .

From: Khaja Ahmed <[email-masked]>
Date: Mon, 17 Jul 2000 13:01:42 -0400

-----Original Message-----
From: Rich Salz

>I don't understand why RPP is necessary in the Identrus model.
>You only need to set up peering relationships among banks, as long as
>each cert has a service locator of some type.

The reasoning behind this is that it makes it:

1.) Easier to build relying party applications because you dont burden them
with RFC.2459 section 6.1 compliant path processing.

and

2.) Allows the banks to provide value add services beyond certificate
validation.  i.e. validation of the transaction itself.  The thinking is
that the relying party (in some transactions) the seller doesn't simply want
to know whether or not the buyer's certificate is good.  He may want to know
if she is good for money, has the required funds/credit rating etc.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 17 Jul 2000 18:43:05 +0100

Khaja,

> validation.  i.e. validation of the transaction itself.  The thinking 
> is that the relying party (in some transactions) the seller doesn't simply 
> want to know whether or not the buyer's certificate is good.  He may want 
> to know if she is good for money, has the required funds/credit rating 
> etc.

This is the where I think you get outside PKIX's scope (in fact, 
I'd argue, outside PKI's scope). I don't believe that either OCSP-X or 
SCVP is, or should be, a suitable protocol for carrying this application 
specific stuff. Sounds to me a bit like "if all you've got is a hammer, 
the whole world's a nail...", which I wouldn't consider a good basis
for designing protocols. (Even though, in Baltimore's case, one of the 
things we do have is a thumping big PKI hammer:-) Of course, pragmatism 
may dictate otherwise for what I'd think will be a relatively short-ish 
period.

Having said that, some types of RPP are in scope of PKIX, and do 
overlap with your #2 above. That is, I think that it is a real 
requirement in lots of environments, (including yours), to be able 
to carry RPP requests/responses inside other protocols, like the 
XML one you posit.

So, my personal answer to your original question would be that 
SCVP is not the protocol you're looking for (and neither is OCSP-X,
before someone asks!).

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 647 7406
61 Fitzwilliam Lane,                    fax: +353 1 647 7499
Dublin 2.                mailto:[email-masked]
Ireland                             http://www.baltimore.com

---

From: Rich Salz <[email-masked]>
Date: Mon, 17 Jul 2000 14:26:06 -0400

I'm still confused.  Identrus is a closed PKI, each customer speaks only
to its bank and banks speak to each other. There is no
cross-certification.
There is a single root, and a single path from between any two Identrus
participants.  Taking those things together, I still don't see how/why
RPP is necessary.

---

From: Denis <[email-masked]>
Date: Mon, 17 Jul 2000 20:37:48 +0200

Khaja,

See my comments below.

> > You only need to set up peering relationships among banks, as
> > long as each cert has a service locator of some type.

> 1.) Easier to build relying party applications because you dont
> burden them with RFC.2459 section 6.1 compliant path processing.

True.

> and
>
> 2.) Allows the banks to provide value add services beyond
> certificate validation.  i.e. validation of the transaction
> itself.  The thinking is that the relying party (in some
> transactions) the seller doesn't simply want to know whether or
> not the buyer's certificate is good.  He may want to know if she
> is good for money, has the required funds/credit rating etc.

 ... but in that case some details of the transaction would need to
be passed along on that protocol (this is not the case today).
However, as soon as this is done, there are deep implications.

Let us take an example: Let us assume that the request is for funds
up to 100.000 $. Is the bank going to count down a credit line ?

If no, then 8 relying parties might be fooled because everything was
nice for 2 such transactions, but not 10.

If yes, then there is some count down, but then the requesters had
better to be authenticated otherwise there would be some easy denial
of service attacks.

So what are your views on that topic ?

Regards,

Denis