Subject: Re: TAM as a new WG item?

From: "Denis Pinkas" <[email-masked]>
Date: Tue, 15 Jan 2008 15:40:25 +0100

The requirements document should first use the concept of "validation policy" 
originally defined in RFC 3379 and used in RFC 5055 
(Server-Based Certificate Validation Protocol (SCVP).

From RFC 3379 (DPV and DPD Protocol Requirements):

7. Validation Policy

   A validation policy is a set of rules against which the validation of
   the certificate is performed.

   A validation policy MAY include several trust anchors.  A trust
   anchor is defined as one public key, a CA name, and a validity time
   interval; a trust anchor optionally includes additional constraints.
   The use of a self-signed certificate is one way to specify the public
   key to be used, the issuer name, and the validity period of the
   public key.

   Additional constraints for each trust anchor MAY be defined.  These
   constraints might include a set of certification policy constraints
   or a set of naming constraints.  These constraints MAY also be
   included in self-signed certificates.

   Additional conditions that apply to the certificates in the path MAY
   also be specified in the validation policy.  For example, specific
   values could be provided for the inputs to the certification path
   validation algorithm in [PKIX-1], such as user-initial-policy-set,
   initial-policy-mapping-inhibit, initial-explicit-policy, or initial-
   any-policy-inhibit.

   Additional conditions that apply to the end-entity certificate MAY
   also be specified in the validation policy.  For example, a specific
   name form might be required.

   In order to succeed, one valid certification path (none of the
   certificates in the path are expired or revoked) MUST be found
   between an end-entity certificate and a trust anchor and all
   constraints that apply to the certification path MUST be verified.

An application will be associated with at least one validation policy.

The validation policy may support schemes described in draft-shimaoka-multidomain-pki 
(Memorandum for multi-domain Public Key Infrastructure Interoperability).

This means that the center of the picture is not the management of *one* TA, 
but the management of validation policies that include one *or many* TAs.

As a consequence, there is no management of individuals TAs to consider, 
but a management of validation policies.

The requirements document should be redrafted to take this concern into consideration.

Denis