Subject: Re: SCVP Question regarding Trust Anchors

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 24 Apr 2007 09:13:15 +0200

The comment from Julien is correct: multiple trust anchors with different conditions are not permittted, 
unless using a specific OID for the validation policy and have all the parameters known by the server.

>You are right, in my personal opinion, that would be a better 
>structure.  Can you propose text?

In order to allow it, this would have required a small change in the ASN.1 structure.
I made this remark to Tim, when he was editing the document, but it was not accepted.

If a client wants to specify different parameters for each trust anchor, 
multiple calls will need to be made.

Denis

>
>Russ
>
>
>At 11:44 AM 4/23/2007, Julien Stern wrote:
>
>>Folks,
>>
>>sorry to ask this fairly late in the process, but it did not catch
>>my eye before:
>>
>>The ValidationPolicy structure defines
>>- userPolicySet
>>- inhibitPolicyMapping
>>- requireExplicitPolicy
>>- inhibitAnyPolicy
>>
>>globally and not on a per trust-anchor basis.
>>
>>Wouldn't it be more logical and less limiting to define it for each
>>trust anchor (like in RFC3125)... ?
>>
>>Regards,
>>
>>--
>>Julien