Subject: Re: TSP interop update

From: [email-masked] (Peter Gutmann)
Date: Sun, 3 Feb 2002 18:46:57 +1300 (NZDT)

Denis Pinkas <[email-masked]> writes:

>>To some extent, although you'd need to allow anyPolicy to allow the client to
>>specify that if it can't get an exact match, anything will do.
>
>If anything will do, then the client does not need to request any specific
>policy.

And how does this help if the client wants one of a set of policies, but failing
that anything will do, as I mentioned in the original text?

>In a negotiation protocol, the client states what it is ready to accept and
>mentions its order of preferences. Then the server chooses among the list.

But why this obsession with having the *server* make the decision?  The
*client* knows what it wants, so the client should make the decision, not the
server.  I'm just wondering here, is there some recommended design philosophy
which I'm not aware of which says that the client can never make any decisions
for itself but always has to leave it to others to make on its behalf?

Peter.

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 04 Feb 2002 10:52:24 +0100

Peter,

> that anything will do, as I mentioned in the original text?

You can obtain this by making two requests.

> But why this obsession with having the *server* make the decision?  

Please, avoid terms like "obsession".
 
> The *client* knows what it wants, so the client should make the decision, not 
> the server.  I'm just wondering here, is there some recommended design philosophy

Since you are wondering, a design philosophy about negotation has been
discussed at length in the CAT security working group and has lead to 
RFC 2478: 

The Simple and Protected GSS-API Negotiation Mechanism (December 1998)

Denis