Subject: RE: DID & DIP requirements

From: Frank Balluffi <[email-masked]>
Date: Mon, 22 Jan 2001 07:21:52 -0800

Steve Kent said:

> How about the following definition:
> 
> A complete certification path is one that satisfies all of the 
> validation criteria specified in RFC 2459bis and that terminates at a 
> certificate configured as a trust anchor in the server and specified 
> by reference to the policy containing that path, or a path that 
> terminates at a trust anchor certificate supplied by the client in a 
> request.

Good. I find "and specified by reference to the policy containing that path"
a bit awkward. I assume you mean the path satisfies the validation criteria
specified by the policy.

Frank

> -----Original Message-----
> From: Stephen Kent [mailto:[email-masked]]
> Sent: Friday, January 19, 2001 10:37 AM
> To: Frank Balluffi
> Cc: [email-masked]
> Subject: RE: DID & DIP requirements
> 
> 
> Frank,
> 
> >Peter Sylvester said:
> >
> >  > Which server, DPV or DPD?
> >  > The DPV client is assumed not to have trust in anything
> >  > else than the server. The server maintains a trust base. It
> >  > comes to a solution by what local or external means.
> >
> >Since I'm no longer clear about what the differences are 
> between a DPV and a
> >DPD server, whoever is performing the task of discovering 
> paths. Put simply,
> >it is not clear to me that such a server knows when it has 
> discovered a
> >complete path. In other words, there seem to be two types of 
> trust points:
> >points along the path and points at the end of the path.
> 
> How about the following definition:
> 
> A complete certification path is one that satisfies all of the 
> validation criteria specified in RFC 2459bis and that terminates at a 
> certificate configured as a trust anchor in the server and specified 
> by reference to the policy containing that path, or a path that 
> terminates at a trust anchor certificate supplied by the client in a 
> request.
>

---

From: Stephen Kent <[email-masked]>
Date: Mon, 22 Jan 2001 14:48:22 -0500

Frank,

>a bit awkward. I assume you mean the path satisfies the validation criteria

Yes, including trust anchors specified by the policy.

Steve