Subject: RE: DPD & DPV requirements - Let us Recurse

From: "Covey, Carlin" <[email-masked]>
Date: Wed, 10 Jan 2001 11:13:44 -0800

Peter and Kent,

I second Peter's strawman proposal.

-----Original Message-----
From: Peter Sylvester [mailto:[email-masked]]
Sent: Wednesday, January 10, 2001 12:07 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: RE: DPD & DPV requirements - Let us Recurse

<snip>

[Peter]

A strawman proposal: 

A server should have the ability to return in the response
a rather limited set of well-known protocol elements, certs,
crls, ocsp response, pkistatus, DPV response, at least those
that he had used to make up its decision or which it wishes
to communicate to the client for whatever reason. 

[Carlin]

If a DPD server can't return an embedded DPD response from
another DPD server, then the first DPD server has more
constraints on forming a valid certificate path than a DPV
server would have.  (Presumably a DPV server could consult a
DPD server to collect path validation information)

---

From: "Covey, Carlin" <[email-masked]>
Date: Thu, 11 Jan 2001 14:07:45 -0800

Peter,

I second Steve's thank you.  But I question Steve's use of "IF"
in his reply below.  Didn't a previous email mention that a DPV
server might make use of another DPV server without any evidence of
this in the response?  (This was made in the context of a discussion of
transitive trust.)  Does your use of "IF" here imply that outlawing such
"relays" from one DPV (or DPD) server to another might be a legitimate 
way to manage the loop problem?

Regards,

Carlin

-------------------------------
- Carlin Covey
  Cylink Corp.

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Thursday, January 11, 2001 2:37 PM
To: Peter Sylvester
Cc: [email-masked]
Subject: RE: DPD & DPV requirements - Let us Recurse

Peter,

Thanks for pointing out the loop detection requirement that needs to 
be part of the protocol IF we allow these servers to call one another.

Steve