Subject: SCVP validation policy

From: "Liaquat Khan" <[email-masked]>
Date: Wed, 15 Jan 2003 08:15:48 -0000

Hi,

I have a small confusion on the use of validation policy in SCVP. Imagine
the
following scenario:

1) SCVP client does not identify any validation policy in the request
message,
2) SCVP sever therefore uses the default validation policy
3) When providing the SCVP response which validation policy does the server
identify in the valPolicy field?    As Section 4.7.6 of the current SCVP
draft states: "The valPolicy value MUST NOT be id-svp-defaultValPolicy."

The same section also states: "even if the query does not include a
validation policy, the server MUST indicate the validation policy that was
used."

So if the server can't identify the default validation policy, which one
should
it identify?

Regards

Liaquat Khan
Ascertia

----- Original Message -----
From: "Russ Housley" <[email-masked]>
To: <[email-masked]>
Sent: Monday, December 23, 2002 8:40 PM
Subject: SCVP Compliance Matrix

> Dear PKIX Working Group:
>
> In preparation for the upcoming straw poll, I am providing the attached
> compliance matrix for SCVP.  Please review it, and the SCVP specification
> too.  The updated SCVP specification has been submitted for posting in the
> Internet-Draft repository.  If should appear soon.
>
> Have a safe and joyous holiday season,
>    Russ

---

From: Russ Housley <[email-masked]>
Date: Wed, 15 Jan 2003 09:36:04 -0500

Liaquat:

The server must identify the policy that was actually used.  The document 
recommends the development of several application-specific validation 
policies.  IPsec, TLS, and S/MIME seem like obvious applications to address.

Of course, the server is free to assign its own OID for its own validation 
policy.

Russ

At 08:15 AM 1/15/2003 +0000, Liaquat Khan wrote:
>Hi,
>
>I have a small confusion on the use of validation policy in SCVP. Imagine the
>following scenario:
>
>From: "Russ Housley" <<mailto:[email-masked]>[email-masked]>
>To: <<mailto:[email-masked]>[email-masked]>