Subject: Re: I-D ACTION:draft-ietf-pkix-scvp-00.txt

From: "Aram Perez" <[email-masked]>
Date: Tue, 29 Jun 1999 19:21:51 -0700

Hi Paul,

> At 06:24 PM 6/28/1999 -0700, Aram Perez wrote:
>>1) I like the idea of SCVP but if the SCVP response is signed, how does the
>>client verify the signature if it can't handle certs?
>
> It has the public key of the server built-in without a cert. Remember, you
> don't need certs for root keys.

How do you plan to handle a comprised private key?

Thanks,
Aram Perez

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 29 Jun 1999 20:33:53 -0700

>How do you plan to handle a comprised private key?

In the same method you got the bare key: out of band. If the client can't 
parse a cert, it probably can't parse a CRL.

--Paul Hoffman, Director
--Internet Mail Consortium