Subject: Cautionary Period

From: "Housley, Russ" <[email-masked]>
Date: Thu, 10 Jan 2002 15:10:21 -0500

The updated Delegated Path Validation (DPV) and Delegated Path Discovery 
(DPD) Protocol Requirements document <draft-ietf-pkix-dpv-dpd-req-01.txt> 
was recently posted.  You may notice that I am a co-author with Denis on 
this document.  Denis invited me to be a co-author because I submitted many 
comments.  There were many, many editorial ones.  There were also technical 
ones.  Denis and I were able to resolve the vast bulk of the technical 
issues; however, we have not been able to reach a compromise on one open 
issue.  That issue is the subject of this note.

I encourage everyone to read DPV and DPD requirements document, and post 
their view on this subject.  I believe that the document expresses Denis' 
view on the issue.  My view is that cautionary period is a not a 
requirement for DPV or DPD.  However, cautionary periods might be used as 
part of an application-specific risk mitigation mechanism when trying to 
determine the validity of a particular signature.  For example, waiting for 
cautionary period before considering a signature to be valid on a 
high-value electronic contract may be prudent.  Therefore, cautionary 
periods might be supported in DSV (delegated signature validation).

Since Denis and I were unable to resolve this issue in an author-to-author 
dialogue, I am bring this issue to the whole mail list.  As far as I know, 
this is the only open issue with the DPV and DPD Protocol Requirements 
document.  I hope that this issue can be quickly resolved so that we can 
get on with the protocol development.

Russ

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 11 Jan 2002 14:30:33 -0800

I agree with Russ.  Simpler is better.  Consider IKE vs. JFK.

Mike

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of 
> Housley, Russ
> Sent: Thursday, January 10, 2002 12:10 PM
> To: [email-masked]
> Subject: Cautionary Period
> 
> 
>

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Sat, 12 Jan 2002 11:49:06 -0800

At 3:10 PM -0500 1/10/02, Housley, Russ wrote:
>My view is that cautionary period is a not a requirement for DPV or 
>DPD.  ...  Therefore, cautionary periods might be supported in DSV 
>(delegated signature validation).

Agree.

--Paul Hoffman, Director
--Internet Mail Consortium