Subject: [Fwd: draft-ietf-pkix-dpv-dpd-req-00.txt & draft-ietf-pkix-dsv-req-00.txt]

From: Petra Barzin <[email-masked]>
Date: Mon, 07 Jan 2002 11:09:12 +0100

Denis,

I never received an answer to my mail. Here it is once again!

I guess my timing of the mail wasn't very good since I posted
it during the last IETF meeting. With the wrap up of the meeting
and the christmas season you probably had enough to do.

Could you please answer or comment my questions / remarks now!

Thanks - Petra

Subject: Re: draft-ietf-pkix-dpv-dpd-req-00.txt & draft-ietf-pkix-dsv-req-00.txt
From: Petra Barzin <[email-masked]>
To: Denis Pinkas <[email-masked]>
Cc: pkix <[email-masked]>
Date: Sun, 09 Dec 2001 14:54:28 +0100
List-Id: <ietf-pkix.imc.org>

Denis,

I have three questions/comments regarding your DPV / DPD document:

- I would like to see the signature to be only optional in a DPV response.
You require the DPV response to be integrity protected. But you could
authenticate the server using other means, for example SSL server
authentication.

- A DPV or DPD request can only contain one certificate. Shouldn't it be
possible to include more than one certifiacte in a request?

- Why do I need the optional requestor name in the DPV request and
response? And why is this requestor name not included in the DPD protocol?

Bye - Petra

Denis Pinkas schrieb:

> I have been asked by the co-chairs to prepare a requirements document for
> DPV/DPD. While doing that task, requirements slighly different have been
> identified for DSV. As a result of this request, you will find:
>
> http://www.ietf.org/internet-drafts/draft-ietf-pkix-dpv-dpd-req-00.txt
>
> a document which describes a protocol for the validation of CERTIFICATES
> (and for the discovery of certification paths), and
>
> http://www.ietf.org/internet-drafts/draft-ietf-pkix-dsv-req-00.txt
>
> a separate document which describes a protocol for the validation of
> DIGITAL SIGNATURES.
>
> Both documents, which share several common points, will be presented
> at the next IETF meeting.
>
> Denis

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 07 Jan 2002 14:52:21 +0100

Petra,

A new version has been posted last Friday to the web master. It should be
published "soon". While waiting for the publication, here is an answer to
your comments.

> and the christmas season you probably had enough to do.

You guessed very well. :-)

>   ----------------------------------------------------------------------------
> 
> Objet: Re: draft-ietf-pkix-dpv-dpd-req-00.txt & draft-ietf-pkix-dsv-req-00.txt
> De: Petra Barzin <[email-masked]>
> A: Denis Pinkas <[email-masked]>
> Copies à: pkix <[email-masked]>
> Références: <[email-masked]> <[email-masked]>
> 
> Denis,
> 

The text I have been preparing after the meeting, cares about your concern.

"In order to be able to be confident that the validation of the 
certificate has correctly been done, the client only requires an 
authenticated response. 

In order for the client to prove to another party that trusts the 
same DPV server that the certificate validation was correct, the 
client requires a signed response."
 
> possible to include more than one certifiacte in a request?

This has been corrected. The new text is:

"The Delegated Path Validation (DPV) protocol allows a server to 
validate one or more certificates according to a validation policy. "

> response? 

You do not need an optional requestor name in the DPV request. 
The new text is:

"The server may require client authentication. The authentication 
method to be used may be dependant upon the transport used, and thus 
the client authentication mechanism need not be an integral part of 
the DPV request."

> And why is this requestor name not included in the DPD protocol?

The requestor name will need to be included in the DPD protocol. 
The new text is:

"Policy definition requests SHALL be able to be authenticated so that 
only authorized clients can register policies."

Regards,

Denis