Subject: RE: DPD & DPV Basics

From: "Covey, Carlin" <[email-masked]>
Date: Thu, 11 Jan 2001 14:55:46 -0800

Frank,

See comments below.

-----Original Message-----
From: Frank Balluffi [mailto:[email-masked]]
Sent: Thursday, January 11, 2001 2:31 PM
To: 'Steve Hanna'; PKIX List
Subject: RE: DPD & DPV Basics

<snip>

1. Can someone explain the value of a DPD server returning a path that may
not be valid? 

<snip>

[Carlin]
I agree that returning a path that may not be valid would not be the normal
case.
However, I can think of some circumstances in which it would be useful.

The returned certificate path might include a certificate that has expired,
or which is currently suspended.  The DPD client may be willing to accept
such an invalid chain for certain purposes.  

Another case is a valid chain that traces to a root that is not one of the 
client's trust anchors.  The DPD client might be willing to add that root to

its set of trust anchors. 

A third case is a chain that the DPD client can validate, but the DPD server
cannot.
(For instance, the client may be able validate a certificate signed with
ECDSA,
whereas the server may have no means to do so.)

Regards,

Carlin

--------------------------------------
- Carlin Covey
  Cylink Corp.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 11 Jan 2001 18:22:12 -0500

Carlin,

The examples you cite of benefits from having cert chains returned by 
a DPD server, even if not strictly valid, are examples of the R&D 
problem area I alluded to in earlier messages. I don't think we have 
a good set of parameters to express the "not quite valid, but maybe 
close enough to be useful" notion you are describing.  We would need 
a specific set to be part of the spec, else we will not be able to 
have a good spec for server operation, nor for client control of 
server operation.  So, I'd discourage heading down this path uless we 
have such a set of parameters, and Wg agreement on their desirability 
and completeness.

Steve

---

From: Steve Hanna <[email-masked]>
Date: Fri, 12 Jan 2001 14:31:26 -0500

Thank you, Carlin, for pointing out several cases where it might be
useful for a DPD server to return an invalid or unvalidated path.

I'm glad to see that you and Steve Kent have agreed that these cases
should not be addressed at this time. They can be addressed later by
adding parameters that the client could use to describe what sort of
invalid or unvalidated paths it is willing to accept.

-Steve