Subject: Re: SCVP Internal Error...

From: Peter Sylvester <[email-masked]>
Date: Tue, 3 Jun 2003 17:33:58 +0200 (MET DST)

> 
> I agree.  An additional error code should be defined.
> 

Or :

      ResponseStatus ::= SEQUENCE {
        statusCode            SCVPStatusCode,
        errorMessage      [0] UTF8String OPTIONAL }

      SCVPStatusCode ::= ENUMERATED {
        okay                    (0),
        skipUnrecognizedItems   (1),
        tooBusy                (10),
        badStructure           (20),
        unsupportedVersion     (21),
        abortUnrecognizedItems (22),
        unrecognizedSigKey     (23),
        badSignature           (24),
        unableToDecode         (25),
        notAuthorized          (26),
        unsupportedChecks      (27),
        unsupportedWantBacks   (28),
        unsupportedSignature   (29),
        invalidSignature       (30),
        relayingLoop           (40) }

could be replaced by (after adding one code for relaying and 
removing the the word TSA). 

  PKIStatusInfo ::= SEQUENCE {
      status        PKIStatus,
      statusString  PKIFreeText     OPTIONAL,
      failInfo      PKIFailureInfo  OPTIONAL
  }

  PKIStatus ::= INTEGER {
      accepted                (0),
      -- you got exactly what you asked for
      grantedWithMods        (1),
      -- you got something like what you asked for; the
      -- requester is responsible for ascertaining the differences
      rejection              (2),
      -- you don't get it, more information elsewhere in the message
      waiting                (3),
      -- the request body part has not yet been processed; expect to hear
      -- more later (note: proper handling of this status response MAY
      -- use the polling req/rep PKIMessages specified in Section 3.3.22;
      -- alternatively, polling in the underlying transport layer MAY
      -- have some utility in this regard)
      revocationWarning      (4),
      -- this message contains a warning that a revocation is
      -- imminent
      revocationNotification (5),
      -- notification that a revocation has occurred
      keyUpdateWarning       (6)
      -- update already done for the oldCertId specified in
      -- CertReqMsg
  }

  PKIFailureInfo ::= BIT STRING {
  -- since we can fail in more than one way!
  -- More codes may be added in the future if/when required.
      badAlg              (0),
      -- unrecognized or unsupported Algorithm Identifier
      badMessageCheck     (1),
      -- integrity check failed (e.g., signature did not verify)
      badRequest          (2),
      -- transaction not permitted or supported
      badTime             (3),
      -- messageTime was not sufficiently close to the system time,
      -- as defined by local policy
      badCertId           (4),
      -- no certificate could be found matching the provided criteria
      badDataFormat       (5),
      -- the data submitted has the wrong format
      wrongAuthority      (6),
      -- the authority indicated in the request is different from the
      -- one creating the response token
      incorrectData       (7),
      -- the requester's data is incorrect (for notary services)
      missingTimeStamp    (8),
      -- when the timestamp is missing but should be there (by policy)
      badPOP              (9),
      -- the proof-of-possession failed
      certRevoked         (10),
         -- the certificate has already been revoked
      certConfirmed       (11),
         -- the certificate has already been confirmed
      wrongIntegrity      (12),
         -- invalid integrity, password based instead of signature or 
         -- vice versa
      badRecipientNonce   (13),
         -- invalid recipient nonce, either missing or wrong value
      timeNotAvailable    (14),
         -- the TSA's time source is not available
      unacceptedPolicy    (15),
         -- the requested TSA policy is not supported by the TSA.
      unacceptedExtension (16),
         -- the requested extension is not supported by the TSA. 
      addInfoNotAvailable (17),
         -- the additional information requested could not be understood
         -- or is not available
      badSenderNonce      (18),
         -- invalid sender nonce, either missing or wrong size
      badCertTemplate     (19),
         -- invalid cert. template or missing mandatory information
      signerNotTrusted    (20),
         -- signer of the message unknown or not trusted
      transactionIdInUse  (21),
         -- the transaction identifier is already in use
      unsupportedVersion  (22),
         -- the version of the message is not supported  
      notAuthorized       (23),
         -- the sender was not authorized to make the preceding request
         -- or perform the preceding action
      systemUnavail       (24),
      -- the request cannot be handled due to system unavailability
      systemFailure       (25),
      -- the request cannot be handled due to system failure
      duplicateCertReq    (26)
      -- certificate cannot be issued because a duplicate certificate
      -- already exists
  }

---

From: "Trevor Freeman" <[email-masked]>
Date: Wed, 4 Jun 2003 12:24:09 -0700

Hi Faisal,
While you proposal does make the exchange between the client and server
more economic, it does so at the cost of code complexity which leads to
more complicated client testing. We would open up testing combinations
of responses to ensure the client deals with any sequence of status from
the server. 
That is not good, so I think bandwidth will have to suffer.

Trevor

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Faisal
Sent: Wednesday, June 04, 2003 3:43 AM
To: Peter Sylvester <Peter.Sylvester; Frank Balluffi
Cc: [email-masked]; [email-masked]
Subject: Re: SCVP Internal Error...

Hi,

    I prefer additional status code value rather than modifying the
structure

Regards,
Faisal

----- Original Message -----
From: "Frank Balluffi" <[email-masked]>
To: "Peter Sylvester <Peter.Sylvester" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Tuesday, June 03, 2003 10:15 PM
Subject: Re: SCVP Internal Error...

>
>
> I prefer adding additional SCVPStatusCode values over modifying the
structure of ResponseStatus. It may also be necessary to add additional
ReplyStatus values.
> Frank
>                       Peter Sylvester
>                       <Peter.Sylvester@        To:
[email-masked]
>                       edelweb.fr>              cc:
>                       Sent by:                 Subject:  Re: SCVP
Internal
Error...
>                       owner-ietf-pkix@m
>                       ail.imc.org

>                       06/03/2003 11:33
>                       AM
> --
> This e-mail may contain confidential and/or privileged information. If
you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden.