Subject: SCVP Validation OID

From: "Faisal Maqsood" <[email-masked]>
Date: Tue, 14 Sep 2004 17:37:10 +0500

Hi All,

Question 1
--------------
I need to know that if fullPolResponse is set to TRUE then what values are set in valPolResponse and validaionPolRef in SCVP Response. After reading the draft 15 doc, in my opinion, if fullPolResponse is TRUE then valPolResponse is set and returned and validaionPolRef is not set. If fullPolResponse is FALSE then validationPolRef is set and valPolResponse is not set. Can some one clarify.

Question 2
------------
Is validationAlg (defined in 3.2.12) is the same as explained in section 1.3 ? i.e. The validationAlg in 3.2.12 will be used by server to define default inputs to the certificate path processing.

Question 3
-------------
How would server behave if in a SCVP Request user has set both validationAlg and validationPolRef  where validationAlg points to a default validation algorithm?

Question 4
-------------
If server defines an OID and bound some configuration with this OID, e.g. TrustAnchors, RevocationInfo, ValidationParameters etc then will client either use this OID in ValidationAlg or in validationPolRef ?

Regards,
Faisal

---

From: "Trevor Freeman" <[email-masked]>
Date: Fri, 17 Sep 2004 15:48:27 -0700

Hi Faisal,

I did find some text left over from 14 where we did talk about using
validation alg to represent parameter but that has been removed from 16.
The only place to define parameters ( TA, policy etc) is the policy. The
algorithm represent how the parameters are evaluated.

If the policy already defines an algorithm then passing the same
algorithm OID is benign and redundant. Passing a different algorithm OID
in the request is an error.

Trevor

________________________________

From: Faisal Maqsood [mailto:[email-masked]] 
Sent: Tuesday, September 14, 2004 11:25 PM
To: Trevor Freeman; [email-masked]
Subject: Re: SCVP Validation OID

Hi Trevor,

I am slightly confused with the answers given. What I have understood by
the answer of Question 2 is that Server can define customizable OIDs and
associate TrustAnchors, policy oid associated with each TA, revocation
information (CRLs, OCSP Responses) etc but in section 3.2.21 its stated
that "client and server can optionally agree a set of parameters which
may fully or partially define a validation policy". I believe that these
set of parameters are similar to the one defined by validationAlg (See
answer to Question 2 below). If I am correct then I don't think there is
a need for a seperate validationPolRef.

In the answer to question 4, you have stated that "If the referenced
policy also defines an algorithm then the algorithm OID can be omitted
from the request". What do you mean by omitted ? Does this mean to
ignore it by server ?

Can you please tell me what is expected date to publish draft 16 ?

Regards,

Faisal

	----- Original Message ----- 

	From: Trevor Freeman <mailto:[email-masked]>  

	To: Faisal Maqsood <mailto:[email-masked]>  ;
[email-masked] 

	Sent: Tuesday, September 14, 2004 22:17

	Subject: RE: SCVP Validation OID

	Hi All,

	Question 1

	--------------

	I need to know that if fullPolResponse is set to TRUE then what
values are set in valPolResponse and validaionPolRef in SCVP Response.
After reading the draft 15 doc, in my opinion, if fullPolResponse is
TRUE then valPolResponse is set and returned and validaionPolRef is not
set. If fullPolResponse is FALSE then validationPolRef is set and
valPolResponse is not set. Can some one clarify.

	[TF] If a policy has been specified it should always be used.
The only difference should be whether the actual values are include in
addition to the policy. This has been clarified in 16.

	Question 2

	------------

	Is validationAlg (defined in 3.2.12) is the same as explained in
section 1.3 ? i.e. The validationAlg in 3.2.12 will be used by server to
define default inputs to the certificate path processing.

	[TF] Yes they are the same.

	Question 3

	-------------

	How would server behave if in a SCVP Request user has set both
validationAlg and validationPolRef  where validationAlg points to a
default validation algorithm?

	[TF] 3.2.21 states "If there are any conflicts between the
policy referenced in the request and any supplied values in the request
then the server MUST return an error."

	Question 4

	-------------

	If server defines an OID and bound some configuration with this
OID, e.g. TrustAnchors, RevocationInfo, ValidationParameters etc then
will client either use this OID in ValidationAlg or in validationPolRef
?

	[TF] If the referenced policy also defines an algorithm then the
algorithm OID can be omitted from the request.

	Regards,

	Faisal