Subject: SCVP additions

From: Stephen Kent <[email-masked]>
Date: Thu, 18 Sep 2003 18:40:17 -0400

Folks,

Based on the discussions of the last 2 weeks, I think there is a need 
to augment the SCVP text to specify what an SCVP client does in terms 
of validating responses from an SCVP server. Long ago we discussed 
the need for a FSM-style description, when we were developing rules 
for evaluating candidate DPD/DPV protocols, and it seems to be absent 
from the SCVP spec.

Several different cases have been identified: dumb client using SCVP 
for DPV, smart client using SCVP for DPD, and SCVP server acting as a 
client for DPV or DPD. The requirements may be different for each of 
these cases, in terms of what data must be configured in a client, 
how the user knows what the client will do based on the config, etc. 
This sort of requirement is analogous to what IPsec mandates re 
administrative capabilities for SPDs, to allow a user to know what 
the IPsec implementation will do based on the SPD configuration. Note 
that in IPsec there are different requirements imposed on hosts vs. 
security gateways, so the idea of different requirements for 
different classes of implementation is not new.

Trevor, please think about how this can be accommodated in the next 
rev of the document.  You may want to post text for this topic as you 
and your co-authors develop proposed requirements for the different 
cases, so the WG can discuss them separate from the rest of the 
document.

Steve

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 19 Sep 2003 09:00:59 +0200

Steve,

> Based on the discussions of the last 2 weeks, I think there is a need to 
> augment the SCVP text to specify what an SCVP client does in terms of 
> validating responses from an SCVP server. Long ago we discussed the need 
> for a FSM-style description, when we were developing rules for 
> evaluating candidate DPD/DPV protocols, and it seems to be absent from 
> the SCVP spec.
> 
> Several different cases have been identified: dumb client using SCVP for 
> DPV, smart client using SCVP for DPD, 

Please add to this list: smart client using SCVP for DPV,

Denis

 > and SCVP server acting as a client
> for DPV or DPD. The requirements may be different for each of these 
> cases, in terms of what data must be configured in a client, how the 
> user knows what the client will do based on the config, etc. This sort 
> of requirement is analogous to what IPsec mandates re administrative 
> capabilities for SPDs, to allow a user to know what the IPsec 
> implementation will do based on the SPD configuration. Note that in 
> IPsec there are different requirements imposed on hosts vs. security 
> gateways, so the idea of different requirements for different classes of 
> implementation is not new.
> 
> Trevor, please think about how this can be accommodated in the next rev 
> of the document.  You may want to post text for this topic as you and 
> your co-authors develop proposed requirements for the different cases, 
> so the WG can discuss them separate from the rest of the document.
> 
> Steve
>