Subject: Re: TSP interop update

From: Peter Sylvester <[email-masked]>
Date: Thu, 31 Jan 2002 19:38:48 +0100 (MET)

> 
> You would like the following : when a client asks for a specific policy 
> he may get back a different one that is supposed to be "equivalent" 
> *in the opinion of the server*. 

No. I simply wanted an explanation why You have
changed the text in draft version 4,
and/or to remove in one way or another the current 
inconsistencies in the text since on one side it tell 
'SHOULD be identical' and on one side 'MUST return the same value'.

Below You gave the first indication of a response. 'because
You are not in favor.' So be it.  

IMO It is outside the protocol to interprete the meaning of
a possible different value in the policy. 

> 
> I wonder if this will be considered as equivalent in the opinion of the
> client as well. I am not in favor of supporting such a feature since it
> would open endless disputes. In addition, the client would not even be able
> to prove that he got the equivalent policy in response to another one 
> and thus would not be able to prove that the server is responsible for 
> a misuse.

What endless disputes? Among whom? A client can never 'prove' that
a response is not conformant to what he had requested for the simple
reason that a client cannot prove to someone else that he had send 
a particular request. 

Or, how can a client 'prove' or 'determine' that a response to a 
request without a policy is 'acceptable'?

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Fri, 01 Feb 2002 00:33:47 +0100

Peter Sylvester wrote:

> A client can never 'prove' that

If people really need this kind of proof that means it could be an interesting
extension to require the server to include the hash of the request inside an
extension in the token.