Subject: RE: DPD & DPV requirements

From: "Slone, Skip" <[email-masked]>
Date: Wed, 10 Jan 2001 15:51:39 -0500

Given the discussion generated on the topic of recursion, it seems we should
probably assume that in some cases, DPx servers will turn around and behave
as DPx clients in response to a given query. Rather than debate the merits
of recursion, I would like to suggest the following minor changes in the
requirements (to allow a client to specify whether recursion is an
acceptable practice, and if so, to what extent): 

(1) Change 1.4 to add DPV to the list of acceptable sources of revocation
status. 

(2) Add a new 1.x clause to allow the client to specify whether recursion of
this sort is permitted. This could be either a boolean (to give a simple
yes/no answer) or it could be an integer with count-to-zero semantics
similar to that of inhibitPolicyMapping in X.509. (One could argue that this
could be implied by the policy in clause 1.9, but it seems like something
that ought to be made explicit.)

-- Skip Slone

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Friday, December 29, 2000 1:25 PM
To: PKIX-List
Subject: DPD & DPV requirements

As promised, here is the strawman requirements specification for DPV and
DPD. Questions that the WG needs to address as part of deciding on the scope
of these requirements are in boldface. 

[snip]

---

From: Stephen Kent <[email-masked]>
Date: Wed, 10 Jan 2001 17:09:31 -0500

Skip,

If we do agree to support DPV server recursion, then the suggested 
changes are appropriate ones to consider.

First, though, on what basis would you propose that a client 
enable/disable recursion or set a depth limit? Since a client is 
completely dependent on a DPV server to answer a query, and has no 
local means of validating any supporting data sent along with the 
answer, what does recursion say about the trust that the client 
places in the server? If one believes that trust is transitive, 
recursion may well be fine, and a simple numerical limit on depth of 
recursion would not seem to be a good way to express limits on the 
transitivity (e.g., one bad choice of a DPV server for reliance is 
enough to kill you). If you don't think trust is transitive, then 
recursion is inappropriate, unless you operate in a closed 
environment where the recursion is among servers operated by the same 
org and is really just an internal decision on how to implement the 
server.

Perhaps this is one reason why I am not yet comfortable with adding 
recursion to servers. I'd like to see some analysis of why it makes 
sense, whether it makes sense for both DPD and DPV, etc.

Steve