Subject: SCVP Structure Suggestions

From: "Faisal Maqsood" <[email-masked]>
Date: Thu, 22 Jul 2004 18:54:47 +0500

Hi,

I have been looking at the SCVP Draft 14 and I think it can be improved a bit. 
(I know draft 15 is published but these changes are also not there)

Note: My proposed ASN Structure might not be 100% correct and I have not fully calculated its pros or cons.
  1.. I don't find any good reason of placing "request" Octet String inside CVRequest. I think it should be removed 
  2.. The CVResponse->request and CVResponse->response should also be removed as I don't find any real use of this. 
  3.. In the CVRequest->Query one can specify Checks and WantBack. Request ASNStructure should be similar to the strategy used in the CVResponse->CertReply i.e CertChecks and WantBack should also be present along with Cert. I would propose the following structure.
Query ::= SEQUENCE { 
 QueriedCerts SEQUENCE SIZE (1..MAX) OF CertConfig, 
 Checks     [0] CertChecks OPTIONAL,
 WantBack    [1] WantBack OPTIONAL,
 .....
    }

CertConfig::= SEQUENCE{
 Cert  CertReference,
 Checks      [0] CertChecks OPTIONAL,   
 WantBack    [1] WantBack   OPTIONAL
}

Note: Placing CertChecks and WantBack in Reference ASN Structure have 3 benefits 
  a.. User can define WantBack, CertChecks for each Certificate seperately providing greater flexibility. The CVResponse->CertReply ASN structure already supports seperate WantBack, CertChecks for each Certificate. 
  b.. WantBack, CertChecks inside CVRequest->Query ASN Structure should remain to provide default settings but would be OPTIONAL. If in CertConfig one does not provide WantBack and CertChecks then these default values (CVRequest->Query->WantBack, CVRequest->Query->CertChecks) MUST be present and used. 
  c.. Benefit of providing Checks and WantBack inside Query would be to allow some or all of the Cert inside CertConfig to use default Checks + WantBack settings thus reducing CVRequest size and thus reduces network load.
    4.    CVResponse structure needs also to be update to map with CVRequest options by introducing two new optional objects as below:

    CVResponse ::= SEQUENCE { 
         scvpVersion INTEGER, 
         .......
         ReplyChecks [8] ReplyChecks OPTIONAL, 
         ReplyWantBacks [9] ReplyWantBacks OPTIONAL
     }

In addition CertReply ASNStructure should also be changed to make ReplyChecks and ReplyWantBacks as optional.

Also in Query, all flags (RequestRefHash, IncludePolResponse, InhibitPolMap, RequireExplicitPol, IgnoreAnyPol, IsCA) should be optional instead of mendatory as all these have default values and to make these optional will reduce network load.

Regards,
Faisal Maqsood