Subject: RE: DPD & DPV requirements - return one or more sets of certifica tion paths

From: "Covey, Carlin" <[email-masked]>
Date: Tue, 2 Jan 2001 11:25:26 -0800

Steve and PKIX working group,

I think Steve has done an excellent job is setting forth a proposed set of
requirements for evaluating DPD and DPV standards.

Thank you Steve.  This should help us on the way to reaching closure on this
important set of standards.

That said, I'd like to weigh in with some suggested revisions to Steve's
proposal.  I'll make each suggestion in a separate posting,
with a view to generating more, but shorter and more focused discussion
threads.

From Steve's email sent Friday, December 29, 2000 11:25 AM :
          "2.2 A server must be able to return one or more sets of
certification paths and associated revocation data as a result of path 
           discovery/validation..     .."

This requirement is a bit ambiguous. It probably is intended to mean that
the server must be able to return one or more sets of 
certification paths and associated revocation data related to a single
target certificate. However, the wording
could be interpreted as meaning that the server must be able to return this
information for a set of (possibly unrelated) target
certificates. My preference is for the former. I suggest the following
revision:

                               "2.2 A server must be able to return one or
more sets of certification paths and associated 
                                 revocation data as a result of path
discovery/validation related to a single target certificate." 

.Regards to all, and Happy New Year!

- Carlin Covey

---

From: Stephen Kent <[email-masked]>
Date: Thu, 4 Jan 2001 09:07:44 -0500

Carlin,

>I think Steve has done an excellent job is setting forth a proposed 
>set of requirements for evaluating DPD and DPV standards.
>
>Thank you Steve.  This should help us on the way to reaching closure 
>on this important set of standards.
>

Thanks for the compliment, and the help in refining the requirements.

>
>That said, I'd like to weigh in with some suggested revisions to 
>Steve's proposal.  I'll make each suggestion in a separate posting,
>with a view to generating more, but shorter and more focused 
>discussion threads.
>
>This requirement is a bit ambiguous. It probably is intended to mean 
>that the server must be able to return one or more sets of
>certification paths and associated revocation data related to a 
>single target certificate. However, the wording
>could be interpreted as meaning that the server must be able to 
>return this information for a set of (possibly unrelated) target
>certificates. My preference is for the former. I suggest the 
>following revision:
>
>                                "2.2 A server must be able to return 
>one or more sets of certification paths and associated 

Good point.  If the WG wants to require support for multiple target 
certificates per request/response, we can add that as a separate 
requirement.  I will update the spec based on your comments.

Steve