Subject: RE: Unsigned DPD responses for SCVP15

From: "Trevor Freeman" <[email-masked]>
Date: Tue, 13 Jul 2004 11:28:46 -0700

Hi Mike,
Let me restate the question then. 
The SCVP server publishes a policy document (see SCVP section 6) which
defines the default server behavior for that instance of server and the
set of validation policies it recognizes. We can add a flag to that
policy to indicate the server will only support DPD and in that mode the
server would not sign SCVP responses. We could also add another flag to
say the server was cached responses only.

The alternative if to have the client use a request flag and the server
can either process the request or return an error. If the objective to
support DPD only servers then having the server publish its DPD only
seems cleaner and simpler from the client perspective rather than have
the DPV client try and get an error back.

There is still the unanswered question of the value of having an SCVP
server support mixed mode operation i.e. it can return either signed or
unsigned responses based on the request flag. With the above server
policy flag we can support always sign or never sign which means I can
sign all responses or lock a server to DPD only and never sign
responses. If you want to have a low cost to deploy server then I would
have thought you would lock it down to DPD only. Once you take the cost
hit to deploy a  signing SCVP server, beyond the CPU savings for not
signing some responses, what is the benefit over always signing policy
if you have a signing server given requests can be anonymous?

Therefore to support unsigned DPD do we 

(A) add a flag to the Server policy response (SCVP section 6) to allow
the server to always sign or never sign?
Or
(B) Do we add a flag to the client request to allow the client to
express a preference to sign or not

If we want to support DPD only servers then option A meets that goal. If
we want to support mixed mode operation where a SCVP server can support
both signed and unsigned responses and that that there is tangible
benefits to mixed mode over always signing vs. never signing, then we
need option B.

Trevor

* -----Original Message-----
* From: Michael Myers [mailto:[email-masked]]
* Sent: Tuesday, July 13, 2004 10:26 AM
* To: Trevor Freeman; [email-masked]
* Subject: RE: Unsigned DPD responses for SCVP15
* 
* Trevor,
* 
* I believe Dave, Denis and I thought we were talking two
* alternative mechanisms to address the unsigned DPD consensus:  a
* mechanism based on explicit policy OR a mechanism based on a new
* request flag, as you had earlier posted.
* 
* Your discussion below, i.e. "it seems prudent to have a flag in
* the server policy" is confusing in that context.
* 
* Please clarify what you are asking the WG to consider.
* 
* Mike
* 
* 
* 
* 
* -----Original Message-----
* From: Trevor Freeman [mailto:[email-masked]]
* Sent: Tuesday, July 13, 2004 10:06 AM
* To: Michael Myers; [email-masked]
* Subject: RE: Unsigned DPD responses for SCVP15
* 
* 
* 
* Mike,
* We seem to have merges multiple threads here. The question on
* how SCVP
* supports unsigned DPD reprocess was the topic of this thread.
* 
* Tim proposed a new optional flag in the request. Given some of
* the other
* discussions where in some instances SCVP server would be
* unwilling to do
* anything other than return unsigned responses, it seems prudent
* to have
* a flag in the server policy so DPV clients and DPD clients
* wanting
* signed responses don't waste their time. Given that SCVP
* requests can be
* unauthenticated, what is the benefit of having a SCVP server
* which
* returns both signed and unsigned responses depending on the
* unauthenticated request? That scenario today would have the
* server
* signing all response and the client can choose to ignore the
* signature
* if required. Concerns around server security or sever
* scalability, or
* freshness of SCVP responses are address by having a server only
* do
* unsigned DPD responses. I am simply trying to understand what
* problem we
* seek to address by the mixed mode SCVP server.
* 
* Trevor
* 
* * -----Original Message-----
* * From: Michael Myers [mailto:[email-masked]]
* * Sent: Monday, July 12, 2004 6:58 PM
* * To: Trevor Freeman; [email-masked]
* * Subject: RE: Unsigned DPD responses for SCVP15
* *
* * Given the two alternatives of:
* *
* * 1. An approach requiring explicit policies; or
* *
* * 2. Client-side assertion of a new flag as Tim proposed;
* *
* * I prefer #2 for the following reasons.
* *
* * The SCVP I-D asserts no requirement that a server MUST have a
* * unique policy.  The I-D supports this by making optional all
* * such elements beyond the default defined by RFC3280.  An
* * explicit OID-based approach forces the issue for servers that
* * wish to support unsigned DPD.
* *
* * A non-trivial subset of environments don't even know what an
* OID
* * is (think credit unions), let alone the technical details of
* * what must go into a policy as it relates to this context.  The
* * contents of such are not well defined.  Absent that, there
* * exists no basis to implement correponding enforcement logic
* that
* * is ensured to be interoperable across the Internet.
* *
* * The I-D provides no means for technical implementation and
* * enforcement of a policy-based approach; it is
* non-implementable.
* * Further, the I-D provides no means to discriminate between DPD
* * and DPV.  Even assuming in the future a consensus on a
* * technically enforceable security assertion grammar, the
* subject
* * I-D defines no technical means to even say "DPD".
* *
* * Mike
* *
* *
* 
* 
*

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 13 Jul 2004 11:56:06 -0700

Trevor,

There is no requirement that an SCVP server MUST operate under an
explicit and technically enforceable policy document.  There is no SHALL
statement to this effect in the Sections 3, 4 or 5.  A casual parse of
the optional and default elements of SCVP's ASN.1 supports this.

I see that you ultimately restated your original request to the WG.
Thus Russ, Dave, Denis and I are still back to now what is your option
(B).

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Tuesday, July 13, 2004 11:29 AM
To: Michael Myers; [email-masked]
Subject: RE: Unsigned DPD responses for SCVP15

Hi Mike,

policy flag we can support always sign or never sign which means I ca
dsigning some responses, what is the benefit over always signing policy

Trevor