Subject: RE: Unsigned DPD responses for SCVP15

From: "Trevor Freeman" <[email-masked]>
Date: Tue, 13 Jul 2004 10:05:58 -0700

Mike,
We seem to have merges multiple threads here. The question on how SCVP
supports unsigned DPD reprocess was the topic of this thread.

Tim proposed a new optional flag in the request. Given some of the other
discussions where in some instances SCVP server would be unwilling to do
anything other than return unsigned responses, it seems prudent to have
a flag in the server policy so DPV clients and DPD clients wanting
signed responses don't waste their time. Given that SCVP requests can be
unauthenticated, what is the benefit of having a SCVP server which
returns both signed and unsigned responses depending on the
unauthenticated request? That scenario today would have the server
signing all response and the client can choose to ignore the signature
if required. Concerns around server security or sever scalability, or
freshness of SCVP responses are address by having a server only do
unsigned DPD responses. I am simply trying to understand what problem we
seek to address by the mixed mode SCVP server.

Trevor

* -----Original Message-----
* From: Michael Myers [mailto:[email-masked]]
* Sent: Monday, July 12, 2004 6:58 PM
* To: Trevor Freeman; [email-masked]
* Subject: RE: Unsigned DPD responses for SCVP15
* 
* Given the two alternatives of:
* 
* 1. An approach requiring explicit policies; or
* 
* 2. Client-side assertion of a new flag as Tim proposed;
* 
* I prefer #2 for the following reasons.
* 
* The SCVP I-D asserts no requirement that a server MUST have a
* unique policy.  The I-D supports this by making optional all
* such elements beyond the default defined by RFC3280.  An
* explicit OID-based approach forces the issue for servers that
* wish to support unsigned DPD.
* 
* A non-trivial subset of environments don't even know what an OID
* is (think credit unions), let alone the technical details of
* what must go into a policy as it relates to this context.  The
* contents of such are not well defined.  Absent that, there
* exists no basis to implement correponding enforcement logic that
* is ensured to be interoperable across the Internet.
* 
* The I-D provides no means for technical implementation and
* enforcement of a policy-based approach; it is non-implementable.
* Further, the I-D provides no means to discriminate between DPD
* and DPV.  Even assuming in the future a consensus on a
* technically enforceable security assertion grammar, the subject
* I-D defines no technical means to even say "DPD".
* 
* Mike
* 
*

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 13 Jul 2004 10:25:39 -0700

Trevor,

I believe Dave, Denis and I thought we were talking two
alternative mechanisms to address the unsigned DPD consensus:  a
mechanism based on explicit policy OR a mechanism based on a new
request flag, as you had earlier posted.

Your discussion below, i.e. "it seems prudent to have a flag in
the server policy" is confusing in that context.

Please clarify what you are asking the WG to consider.

Mike

-----Original Message-----
From: Trevor Freeman [mailto:[email-masked]]
Sent: Tuesday, July 13, 2004 10:06 AM
To: Michael Myers; [email-masked]
Subject: RE: Unsigned DPD responses for SCVP15

Mike,
We seem to have merges multiple threads here. The question on
how SCVP
supports unsigned DPD reprocess was the topic of this thread.

Tim proposed a new optional flag in the request. Given some of
the other
discussions where in some instances SCVP server would be
unwilling to do
anything other than return unsigned responses, it seems prudent
to have
a flag in the server policy so DPV clients and DPD clients
wanting
signed responses don't waste their time. Given that SCVP
requests can be
unauthenticated, what is the benefit of having a SCVP server
which
returns both signed and unsigned responses depending on the
unauthenticated request? That scenario today would have the
server
signing all response and the client can choose to ignore the
signature
if required. Concerns around server security or sever
scalability, or
freshness of SCVP responses are address by having a server only
do
unsigned DPD responses. I am simply trying to understand what
problem we
seek to address by the mixed mode SCVP server.

Trevor

* A non-trivial subset of environments don't even know what an
OID
* exists no basis to implement correponding enforcement logic
that
* enforcement of a policy-based approach; it is
non-implementable.
* technically enforceable security assertion grammar, the
subject