Subject: [pkix] May SCVP servers implement alternative validation approaches?

From: Matt DeMoss <[email-masked]>
Date: Fri, 2 Sep 2011 10:19:50 -0400

May SCVP be used to validate certificates using alternative schemes
(network perspective, for example) that don't perform the usual path
validation?

I don't know whether to interpret this paragraph from RFC5055 as
prohibiting some of the alternative validation policies that are
currently being explored:

1.6.  Validation Requirements

For a certification path to be considered valid under a particular
   validation policy, it MUST be a valid certification path as defined
   in [PKIX-1], and all validation policy constraints that apply to the
   certification path MUST be verified.

---

From: Piyush <[email-masked]>
Date: Fri, 2 Sep 2011 11:19:11 -0700

As I understand it, the alternative validation schemes should include the
basic pkix cert validation.
So a "network perspective validation algorithm" will first do the basic
chain validation and other constraints or revocation check if needed, and
then use one or more notaries to figure out if the certificate is valid.

-Piyush
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Matt DeMoss
> Sent: Friday, September 02, 2011 7:20 AM
> To: [email-masked]
> Subject: [pkix] May SCVP servers implement alternative validation
> approaches?
> 
prohibiting
> some of the alternative validation policies that are currently being
explored:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix