Subject: RE: SCVP additions

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 18 Sep 2003 16:18:36 -0700

Hi Steve,
Sounds like a good idea. I am about to go on vacation for a couple of
weeks, but I will start this on my return.
Trevor

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Thursday, September 18, 2003 3:40 PM
To: [email-masked]
Subject: SCVP additions

Folks,

Based on the discussions of the last 2 weeks, I think there is a need 
to augment the SCVP text to specify what an SCVP client does in terms 
of validating responses from an SCVP server. Long ago we discussed 
the need for a FSM-style description, when we were developing rules 
for evaluating candidate DPD/DPV protocols, and it seems to be absent 
from the SCVP spec.

Several different cases have been identified: dumb client using SCVP 
for DPV, smart client using SCVP for DPD, and SCVP server acting as a 
client for DPV or DPD. The requirements may be different for each of 
these cases, in terms of what data must be configured in a client, 
how the user knows what the client will do based on the config, etc. 
This sort of requirement is analogous to what IPsec mandates re 
administrative capabilities for SPDs, to allow a user to know what 
the IPsec implementation will do based on the SPD configuration. Note 
that in IPsec there are different requirements imposed on hosts vs. 
security gateways, so the idea of different requirements for 
different classes of implementation is not new.

Trevor, please think about how this can be accommodated in the next 
rev of the document.  You may want to post text for this topic as you 
and your co-authors develop proposed requirements for the different 
cases, so the WG can discuss them separate from the rest of the 
document.

Steve