Subject: Unsigned DPD responses for SCVP15

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 12 Jul 2004 17:09:34 -0700

I have been asked to add unsigned responses for DPD clients to SCVP15.
There are two models proposed on how we accomplish that both of which
meet the requirements for 3379. I would therefore like some feedback on
how the group views the two mechanisms

Global Server Policy that it is DPD only

The first proposal is to make the option controlled by the server as a
global policy. Therefore the server would publish via policy that is
only supports DPD as such never signs a response. DPV client and DPD
clients wanting a signed response then know to use another server.

SCVP Request option to not sign response

The second option is to leave it to the client to signal to the server
it does not need a signature on the response by a new flag in the
request (or its twin the flag indicates it does want a signature on the
response). This allows clients to be benevolent towards the server by
asking it to skip the signature. Server can still at their discretion
still sign.

Needless to say it is possible to hybridize the two but I am hopeful we
can try and keep this as simple as possible be picking on of the two.

Trevor

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 12 Jul 2004 17:55:18 -0700

Trevor,

I prefer the client-side flag option, with absence of the flag
defaulting to no signatures on SCVP responses containing ONLY
{path, rev-info}.

Mike

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Trevor Freeman
Sent: Monday, July 12, 2004 5:10 PM
To: [email-masked]
Subject: Unsigned DPD responses for SCVP15

I have been asked to add unsigned responses for DPD clients to
SCVP15. There are two models proposed on how we accomplish that
both of which meet the requirements for 3379. I would therefore
like some feedback on how the group views the two mechanisms

Global Server Policy that it is DPD only
The first proposal is to make the option controlled by the
server as a global policy. Therefore the server would publish
via policy that is only supports DPD as such never signs a
response. DPV client and DPD clients wanting a signed response
then know to use another server.

SCVP Request option to not sign response
The second option is to leave it to the client to signal to the
server it does not need a signature on the response by a new
flag in the request (or its twin the flag indicates it does want
a signature on the response). This allows clients to be
benevolent towards the server by asking it to skip the
signature. Server can still at their discretion still sign.

Needless to say it is possible to hybridize the two but I am
hopeful we can try and keep this as simple as possible be
picking on of the two.
Trevor

---

From: David Engberg <[email-masked]>
Date: Mon, 12 Jul 2004 22:49:13 -0400

My preference is the same as Mike's (Option #2, server may choose not to 
sign {path, rev-info} unless client indicates signing is required with a 
request flag).

This gives the greatest flexibility to deployers, who can deploy servers 
that either:

   (a) always sign everything

   (b) never sign anything and return errors if requested to

   (c) sign if client asks for a signature, don't sign if client
       doesn't ask and response type permits.

Trevor's Option #1 (Fixed server policy) only permits deployments of (a) 
and (b).  I believe that (c) is a potentially useful configuration, and 
I don't think there's a strong reason to absolutely preclude it.

Thanks

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 13 Jul 2004 08:52:43 +0200

Trevor,

Like Mike and David, I also support Option #2.

Denis

>> meet the requirements for 3379. I would therefore like some feedback 
>> on how the group views the two mechanisms
>>
>>  
>>
>> request (or its twin the flag indicates it does want a signature on 
>> the response). This allows clients to be benevolent towards the server 
>> by asking it to skip the signature. Server can still at their 
>> discretion still sign.
>>
>>  
>>
>> Needless to say it is possible to hybridize the two but I am hopeful 
>> we can try and keep this as simple as possible be picking on of the two.
>>
>> Trevor
>>
> 
>

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 13 Jul 2004 09:06:46 -0700

I hate to keep ringing this bell, but there is no technical
means to say "DPD" in SCVP.  So should the flag-based option
come to pass, it will need to be defined in terms of response
content.  That is, language along the lines of "MAY sign
responses containing ONLY {path, rev-info} but MUST sign
validity assertions."  The flag would sharpen the MAY.

Mike