Subject: RE: DPD & DPV requirements

From: "Covey, Carlin" <[email-masked]>
Date: Tue, 2 Jan 2001 12:13:23 -0800

From Steve's email sent Friday, December 29, 2000 11:25 AM :

                            2.2     A server must be able to return one or
more sets of certification paths and associated revocation data 
                           as a result of path discovery/validation. Each
set shall consist of an ordered list of certificates and associated  
                            CRLs and/or OCSP responses.

The wording concerning an ordered list could use some more specifics. Is the
response to be an ordered list of certificates, followed by an ordered 
list of revocation information (presumably in the same order), or is it to
be an ordered list of certificate/revocation-information pairs?
My preference is for the pairs.

Although  the sort order  is intuitive, it should probably be declared more
explicitly. My preference is for certificate-path order, beginning with the
target certificate. 

I propose the following revised wording:

                       " ...  Each set shall consist of a list of pairs of
certificates and CRLs and/or OCSP responses, in certificate path order.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 4 Jan 2001 09:09:36 -0500

Carlin,

>                             2.2     A server must be able to return 
>one or more sets of certification paths and associated revocation 
>data
>                            as a result of path discovery/validation. 
>Each set shall consist of an ordered list of certificates and 
>associated  
>The wording concerning an ordered list could use some more 
>specifics. Is the response to be an ordered list of certificates, 
>followed by an ordered
>list of revocation information (presumably in the same order), or is 
>it to be an ordered list of certificate/revocation-information pairs?
>Although  the sort order  is intuitive, it should probably be 
>declared more explicitly. My preference is for certificate-path 
>order, beginning with the target certificate.
>
>                        " ...  Each set shall consist of a list of 
>pairs of certificates and CRLs and/or OCSP responses, in certificate 
>path order.

I'm comfortable with this proposed refinement, if there are no objections.

Steve