Subject: RE: DPD & DPV requirements

From: Frank Balluffi <[email-masked]>
Date: Thu, 11 Jan 2001 20:45:36 -0800

Frank Balluffi said:

> >The client should supply some subset of each requested path 
> which must
> >include the least significant certificate and optionally:
> >
> >- one or more intermediate certificates
> >- one or more trusted certificates

Steve Kent said:

> An intermediate cert that is not trusted, but is not the end of a 
> partial path?  Why?  This is getting complicated.

OK. It is difficult for me to imagine a client supplying intermediate
certificates. But requirement 1.1 only supports a single certificate or a
chain:

1.1     A client request can contain a single certificate or a certificate
chain terminating in the "target" certificate, to assist the server in path
construction. 

Would it be valuable for a client to be able to supply the end-entity
certificate and the trusted certificate in the path?

Frank

---

From: Stephen Kent <[email-masked]>
Date: Fri, 12 Jan 2001 17:38:47 -0500

Frank,

>certificate and the trusted certificate in the path?

What if we say that the chain could be partial?

A trust point (anchor) is a root and the client can specify one or 
more of these as part of the path validation parameter set, 
explicitly or via reference.

Steve

---

From: Steve Hanna <[email-masked]>
Date: Fri, 12 Jan 2001 17:51:42 -0500

> >  > partial path?  Why?  This is getting complicated.

One good reason to allow the client to supply to a DPD server an
arbitrary collection of certificates is that this is exactly what's
delivered in a signed S/MIME message: a bunch of certificates that may
be useful in building a path from a trust anchor to the sender. Multiple
intermediate certificates are explicitly allowed.

For instance, I might have an EE cert from Sun, which has CA certs from
Thawte and the Federal Bridge CA. When sending an email, I might include
all of these certs with the message. The DPD server can use these in
conjunction with the client's trust anchors (perhaps a self-signed
Thawte cert) to build a path.

-Steve

---

From: Stephen Kent <[email-masked]>
Date: Fri, 12 Jan 2001 18:10:24 -0500

Steve,

>Thawte cert) to build a path.

OK, that's a good argument! The argument to the server then would be 
a lump (a new ASN.1 construct) of certs, with no implied ordering, 
and the server if left to sort it out.   If a partial or complete 
chain is sent, it is a valid example of the lump of certs model, 
which happens to be ordered already. I could live with that.

Steve