Subject: RE: SCVP Validation OID

From: "Trevor Freeman" <[email-masked]>
Date: Tue, 14 Sep 2004 10:17:43 -0700

Hi All,

Question 1

--------------

I need to know that if fullPolResponse is set to TRUE then what values
are set in valPolResponse and validaionPolRef in SCVP Response. After
reading the draft 15 doc, in my opinion, if fullPolResponse is TRUE then
valPolResponse is set and returned and validaionPolRef is not set. If
fullPolResponse is FALSE then validationPolRef is set and valPolResponse
is not set. Can some one clarify.

[TF] If a policy has been specified it should always be used. The only
difference should be whether the actual values are include in addition
to the policy. This has been clarified in 16.

Question 2

------------

Is validationAlg (defined in 3.2.12) is the same as explained in section
1.3 ? i.e. The validationAlg in 3.2.12 will be used by server to define
default inputs to the certificate path processing.

[TF] Yes they are the same.

Question 3

-------------

How would server behave if in a SCVP Request user has set both
validationAlg and validationPolRef  where validationAlg points to a
default validation algorithm?

[TF] 3.2.21 states "If there are any conflicts between the policy
referenced in the request and any supplied values in the request then
the server MUST return an error."

Question 4

-------------

If server defines an OID and bound some configuration with this OID,
e.g. TrustAnchors, RevocationInfo, ValidationParameters etc then will
client either use this OID in ValidationAlg or in validationPolRef ?

[TF] If the referenced policy also defines an algorithm then the
algorithm OID can be omitted from the request.

Regards,

Faisal

---

From: "Faisal Maqsood" <[email-masked]>
Date: Wed, 15 Sep 2004 11:24:56 +0500

Hi Trevor,

I am slightly confused with the answers given. What I have understood by the answer of Question 2 is that Server can define customizable OIDs and associate TrustAnchors, policy oid associated with each TA, revocation information (CRLs, OCSP Responses) etc but in section 3.2.21 its stated that "client and server can optionally agree a set of parameters which may fully or partially define a validation policy". I believe that these set of parameters are similar to the one defined by validationAlg (See answer to Question 2 below). If I am correct then I don't think there is a need for a seperate validationPolRef.

In the answer to question 4, you have stated that "If the referenced policy also defines an algorithm then the algorithm OID can be omitted from the request". What do you mean by omitted ? Does this mean to ignore it by server ?

Can you please tell me what is expected date to publish draft 16 ?

Regards,
Faisal
  ----- Original Message ----- 
  From: Trevor Freeman 
  To: Faisal Maqsood ; [email-masked] 
  Sent: Tuesday, September 14, 2004 22:17
  Subject: RE: SCVP Validation OID

  Hi All,

  Question 1

  --------------

  I need to know that if fullPolResponse is set to TRUE then what values are set in valPolResponse and validaionPolRef in SCVP Response. After reading the draft 15 doc, in my opinion, if fullPolResponse is TRUE then valPolResponse is set and returned and validaionPolRef is not set. If fullPolResponse is FALSE then validationPolRef is set and valPolResponse is not set. Can some one clarify.

  [TF] If a policy has been specified it should always be used. The only difference should be whether the actual values are include in addition to the policy. This has been clarified in 16.

  Question 2

  ------------

  Is validationAlg (defined in 3.2.12) is the same as explained in section 1.3 ? i.e. The validationAlg in 3.2.12 will be used by server to define default inputs to the certificate path processing.

  Question 3

  -------------

  How would server behave if in a SCVP Request user has set both validationAlg and validationPolRef  where validationAlg points to a default validation algorithm?

  [TF] 3.2.21 states "If there are any conflicts between the policy referenced in the request and any supplied values in the request then the server MUST return an error."

  Question 4

  -------------

  If server defines an OID and bound some configuration with this OID, e.g. TrustAnchors, RevocationInfo, ValidationParameters etc then will client either use this OID in ValidationAlg or in validationPolRef ?

  [TF] If the referenced policy also defines an algorithm then the algorithm OID can be omitted from the request.

  Regards,

  Faisal