Subject: Re: draft-ietf-pkix-dsv-dpv-dpd-req-00.txt

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 30 Oct 2001 10:10:27 -0800

At 7:03 PM +0100 10/30/01, Peter Sylvester wrote:
>  >
>>  Russ is right: the client doesn't always want the supporting data.
>>  Proposal for insertion at the end of the section:
>>
>>  The client may request that the server indicate a valid or not valid
>>  response, that the server return the path of certificates used to
>>  determine a valid response, or that the server return both.
>
>To Paul: Two questions for clarification:
>
>Are You talking about ONE client that sometimes may want just yes no,
>and sometimes it wants more, or about two different types of usage
>scenarios, or of different clients, or ..

I am talking about one "client", but not one application. A client 
could (should!) be an OS function, and that client has applications 
that ask it for either yes/no or a good chain.

>You text described three options for DPV ?
>
>- please tell yes or no.
>- please only return THE path used for validation without telling
>   whether it is good;
>- both of the previous ones?

Correct. You might want both so you can act immediately on a yes but 
store the chain for later use, such as if you are online now but you 
know you won't be later.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 30 Oct 2001 19:03:02 +0100 (MET)

- please tell yes or no.

-------------

To Denis: Regarding the policy issues: 

I suggest to go even futher and split out the policy definition 
and management protocol stuff in order to be able to have a
framework for a basic service as fast as possible without getting
lost in difficulties for policy definitions. In particular, I
would see that the policies for the two services are different
things, for example for DPD a strategy of how to look for
paths, either top down or bottom up, DPV contains all kinds of
information about which certs need to be validated.

Regards
Peter