Subject: [pkix] Question about SCEP transactionID

From: Suomela Tero <[email-masked]>
Date: Thu, 24 Mar 2011 11:51:45 +0200

The SCEP draft has somewhat weird approach to the transactionID:

8.4.  transactionID

   A well-written CA/RA SHOULD NOT rely on the transactionID to be
   correct or as specified in this document.  Requesters with buggy
   software might add additional undetected duplicate requests to the
   CA's queue (or worse).  A well-written CA/RA should never assume the
   data from a requester is well-formed.

So what a well-written CA/RA should then do with the transactionID if it is basically something that you should not rely on? Is there some other option than ignoring the whole transactionID? Of course there are buggy software that don't follow the specification, but I would expect the specification to say what is the correct behaviour in a case like this.

- Tero

---

From: max pritikin <[email-masked]>
Date: Thu, 24 Mar 2011 16:30:37 -0700

The original authors may have a different opinion, but...

The CA should not rely on the client's claims regarding the transactions. The CA's responsibility is to ensure appropriate policy with respect to the certificates ultimately issued. One method the CA might use would be to hash the client's public key and to use that as an index into an internal state database.  

Section 3.1.1.1 transactionID indicates that the client should generate the transactionID using the same method. Furthermore this section indicates that "the transactionID is required so that the requester can match the response message with the outstanding request message". In the implementations I've seen this association can be assumed from context (e.g. POST a request, get a response). 

I agree there isn't substantial value in the transactionID concept. In similar work I didn't include it (see draft-pritikin-est-00).

- max

On Mar 24, 2011, at 2:51 AM, Suomela Tero wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix