Subject: Initial comments on SCVP

From: Michael Myers <[email-masked]>
Date: Fri, 2 Jul 1999 18:28:00 -0700

Ambarish, Paul:

A very timely draft.

I've got to wonder though if we need yet another online protocol or if we'd
be doing our job better by building on our prior work. Both OCSP or DCS have
achieved a fairly stable level of maturity in the IETF.  In fact, OCSP is
now RFC 2560.  Upon reviewing the proposal, it seems to me that either
provide a more stable platform for addressing these requirements.

OCSP was in its inception aimed at solving the more general certificate
validation problem. At the request of several very large stakeholders who
intended to rely on OCSP for Internet-based financial transactions, we chose
to first deal with the revocation problem, recognizing that via
extensibility we were architecting a more general certificate validation
framework.

Let's build on that, especially since it was the original intent of OCSP to
do so.  With the investment people are today making in extensible OCSP, that
only makes sense.

It would relatively straightforward to publish an extensions document. Doing
so, we would have the advantage of incrementally building on a existing RFC
specifically intended to be extended in this fashion, for specifically this
need, rather that totally revinent what that RFC has already established.

Otherwise, what's the advantage of replacing a protocol that has already
been ratified by the working group and promoted to proposed standard status?
Especially since the requirements being met by the proposed protocol are
already met or are intended to be met by extensions to RFC2560?  I just
don't see a compelling case being made for so radical a revision.

I'm compelled to ask the group at large if others share these sentiments.
Perhaps I missed something.

Mike

---

From: "Ambarish Malpani" <[email-masked]>
Date: Mon, 5 Jul 1999 23:00:58 -0700

Hi Mike,
    Thanks for taking the time to read the draft and compose these
comments. Since I am on both the OCSP and SCVP drafts, I think I
need to address them.

I actually see OCSP and SCVP addressing pretty different needs and
most probably pretty different communities of users.

OCSP essentially deals with the status of a certificate (and
potentially, other attributes of the holder/account associated with
that certificate). It is a mechanism for a client to ask for
information about a particular cert.

SCVP is mainly directed at making it easier for applications to use
PKI. Yes, it does deal with cert status, but it also deals with
issues like chain building, policy management etc. The main goals
are:
1. To make it easier for an application to use PKI
2. To make it easier for an organization to deploy PKI (by allowing
them to control policy etc.)

I think of OCSP as being an infrastructure protocol, to help provide
up-to-date status information - something that is run as an underlying
mechanism. I see SCVP as something that is used between a low end client
and a server it trusts, to offload the complicated parts of PKIX.

Hope this clarifies the issue.

More comments inline:

> -----Original Message-----
> From: Michael Myers [mailto:[email-masked]]
> Sent: Friday, July 02, 1999 6:28 PM
> To: [email-masked]
> Subject: Initial comments on SCVP
> 
> 
> Ambarish, Paul:
> 
> A very timely draft.

Thank you.

> extensibility we were architecting a more general certificate 

Mike, I thought it was reasonably clear from previous OCSP debates
that OCSP just returns the status of the certificate(s) asked for -
it doesn't do any additional chain building or chain validation (I
think I remember some explicit comments about that not being part
of OCSP).

> do so.  With the investment people are today making in 

A lot of SCVP was designed after seeing how people were trying to
use OCSP - there are applications where OCSP makes sense. There
are others where SCVP works better.

> need, rather that totally revinent what that RFC has already 

Not at all - OCSP fundamentally assumes that you as a client
will to do all validation yourself and are only using OCSP to
query the status of a certificate. It was never meant to work
in an environment where you had no idea of the chain being used
to validate the certificate - remember we use the issuer and
serial number to identify the certificate - not the certificate
itself.

> Perhaps I missed something.

Regards,
Ambarish