Subject: Revised "rule" for use of "validate" vs. "verify" in PKI docs

From: "Robert W. Shirey" <[email-masked]>
Date: Thu, 21 Jan 1999 12:14:44 -0500

To the Working Group,

In late December, I sent a message to the pkix list to encourage correction
and clean-up of use of the words "validate" and "verify" in IETF security
documents and related material. Subsequently, I have had discussions with
the co-chairs of the pkix WG, Steve Kent and Warwick Ford, and with the the
chair of the Federal PKI Technical Working Group, Bill Burr at NIST, and
others.

Bill wisely suggested it would be better to have a usage rule, rather than
just a list of usage cases. He also wanted to preserve current Federal
usage of "validate" with regard to compliance with to FIPS 140-1 and other
standards.

Warwick showed me that he actually had been following some rules, which I
had not noticed.

Steve convinced me that what I suggested in my December message had some flaws.

So, after they enlightened me as to what is "correct", I synthesized the
following, which articulates a rationale for what Steve and Warwick have
been doing intuitively. All three subsequently concurred with this writeup.

Regards, -Rob-

[email-masked], Phone 703-284-4641, Reception 284-4600, Fax 284-2766
Robert W. Shirey, GTE Internetworking - Mail Stop 30/12B2, Suite 1200
1300 North Seventeenth Street, Arlington, Virginia   22209-3801   USA

P.S. How many people think it would be useful to publish, as an
Informational RFC, a large (say roughly 1,000 terms) security glossary,
sort of in the style of Gary Malkin's networking glossary (RFC 1983)?
Please send replies directly to me and don't bother the list with this.

validate vs. verify
-------------------

The PKI community uses words inconsistently when describing what a
certificate user does to make certain that a digital certificate can be
trusted. Usually, we say "validate the certificate" but say "verify the
signature." Too often, however, verify and validate are used
interchangeably. Here, we recommend a rule, illustrated with some specific
applications, to make usage consistent and also align it with both
generally accepted PKI community practice and the dictionary.

*Rule*: Use "validate" when referring to a process intended to establish
the soundness or correctness of a construct, like a public key certificate
or a certification path. Use "verify" when referring to a process intended
to test or prove the truth or accuracy of a fact or value.

In other words, we verify atomic truths, but we validate data structures,
relationships, and systems that are composed of or depend on verified
items. The rationale for this distinction is as follows:

* Valid derives from a Latin word that means "strong". Validate means "to
establish the soundness of; corroborate" or "to mark with an indication of
official sanction" [American Heritage Dictionary of the English Language,
3rd edition]. Thus, a certificate user validates a public key certificate
to establish trust in the binding that the certificate asserts between an
identity and a key, and NIST validates cryptographic modules for
conformance with FIPS PUB 140-1.

* Verify derives from a Latin word that means "true". Verify means "to
determine or test the truth or accuracy of, as by comparison,
investigation, or reference" or "to prove the truth of by presentation of
evidence or testimony; substantiate" [AHDEL3]. Thus, to validate a
certificate, a certificate user must verify the digital signature on the
certificate, by performing calculations that test it; must verify that the
current time is within the certificate's validity period; and also may need
to validate a certification path involving additional certificates. In an
authentication process, we verify an identity by presenting or generating
identification information.