Subject: Re: I-D ACTION:draft-ietf-pkix-scvp-21.txt

From: [email-masked]
Date: Thu, 3 Nov 2005 12:44:22 +0100

To the list,

One of the major disputes is related to the definition of ValidationPolicy.

Most validation policies will only be referenced by a client using an OID.

In a few cases, one or two parameters which are specific to the validation policies will be needed (all other parameters being fixed).

Parameters defined by the magic sentence ANY DEFINED BY are not that easy to handle, unless for predefined validation policies.

This may be the case for the "basic validation policy".

Hereafter is a proposal :

ValidationPolicy ::= CHOICE {
validationPolicyDef    [0]   ValidationPolicyDef,
preDefinedValPol       [1]   PreDefinedValPol }

ValidationPolicyDef ::= SEQUENCE {
valPolId              OBJECT IDENTIFIER,
valPolParams          SEQUENCE OF ValPolParam  OPTIONAL }

-- ValidationPolicyDef avoids the use of "ANY DEFINED BY".

PreDefinedValPol ::= SEQUENCE {
valAlgId              OBJECT IDENTIFIER,
parameters            ANY DEFINED BY valAlgId OPTIONAL }

-- BasicValPol is the policy described in section 3.2.4.2.1

-- it comes with its own OID and its own parameters and

-- may be supported using PreDefinedValPol.

ValPolParam := SEQUENCE {

id                    OBJECT IDENTIFIER,
value                 BaseObject }

BaseObject ::= CHOICE {
objectlist        SEQUENCE OF SimpleObject,
object            SimpleObject }

SimpleObject ::= CHOICE {
int                        INTEGER,
string                     UTF8String,
oid                        OBJECT IDENTIFIER,
flag                       BOOLEAN,
bitstring                  BIT STRING,
octets                     OCTET STRING,
datetime                   GENERALIZEDTIME,
pKCReference          [0]  PKCReference,
attributeCertificate  [1]  AttributeCertificate }

Denis

---

From: Peter Sylvester <[email-masked]>
Date: Thu, 03 Nov 2005 14:11:52 +0100

The current text has some improvements and simplifications, addressing
some points that I have been repeating since years.
but does not address adequately all the issues that had been discussed
after the Paris meeting with Tim Polk, in particular some are
misunderstood.