Subject: RE: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]

From: Wen-Cheng Wang <[email-masked]>
Date: Sat, 6 Sep 2003 02:57:10 +0800 (CST)

Steve,

Sure, I totally agree that a SCVP server is not necessary to have
a cert. Actually, I am in favor of directly delivering the public-key of the SCVP server to the RP via a secure out-of-band channel.
It is rather unfortunate that the current SCVP ID (draft 12)
seems to require a SCVP server MUST have a cert. The section
4 of the current SCVP ID says "The SCVP server MUST include its
own certificate in the certificates field within SignedData."
I believe the text should be changed.

Best Regards,
Wen-Cheng

Stephen Kent wrote:
> Wen-Cheng Wang,
> As I mentioned in one of my many messages today, there may be no need 
> for an SCVP server to have a cert. If the server is used by only 
> local clients, e.g., in an enterprise context, then the server's 
> public key need not be signed by anyone. certainly, as your note, the 
> server is an EE, not a CA, so the usual self-signed cert model may 
> not apply.
> Steve

---

From: Stephen Kent <[email-masked]>
Date: Fri, 5 Sep 2003 15:25:21 -0400

At 2:57 +0800 9/6/03, Wen-Cheng Wang wrote:
>a cert. Actually, I am in favor of directly delivering the 
>public-key of the SCVP server to the RP via a secure out-of-band 
>channel.

I missed that.  We should see what the editors for the doc say about 
changing the text to say that the server cert is optional.

Steve