Subject: RE: DPV and DPD issues summary [no longer that long :-)]

From: Ambarish Malpani <[email-masked]>
Date: Fri, 09 Feb 2001 07:16:50 -0800

Hi Peter,
    By extending this arguement, would you insist that every
OCSP response contained a CRL (if it was based on a CRL), or
that every SSL certificate contained the request, "company
ownership of domain", RA authorization, [or whatever other info
the CA used to figure out that the request was genuine], ....

I am not sure you could get most protocols to work if you tried
to get all the proof over from the server....

Regards,
Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Architect                                                650.567.5457
ValiCert, Inc.                                  [email-masked]
339 N. Bernardo Ave.                          http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Peter Sylvester [mailto:[email-masked]]
> Sent: Friday, February 09, 2001 3:23 AM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: Re: OCSPv2, DPV and DPD issues summary (long)
> 
> 
> > 
> > There is some confusion here. We are in agreement that it would be 
> > good if each server along a path logged the response from 
> the server 
> > from which it received a response. That does not require nested 
> > responses. Nested responses would be needed if we insisted that a 
> > client needed to be able to assemble this data, rather than relying 
> > on the DPV server(s) to maintain this data.
> > 
> There are two issues: 
> 
> - A server must probably log all activities anyway.
>   So far, this is not the directly visible part of the protocol, 
>   unless we add a protocol to allow to ask a server to ... 
> 
> - But: Whenever wants to know *why* a DPV has responsed, then 
> it should NOT
>   be necessary to go back to the server's logging files. Or, a DPV
>   server should have the possibility to include all relevant 
> information
>   that has contributed to its decision in such a way that a client
>   can easily exploit this by logging or showing to a user or else.  
>

---

From: Peter Sylvester <[email-masked]>
Date: Fri, 9 Feb 2001 16:57:41 +0100 (MET)

> the CA used to figure out that the request was genuine], ....

No, I don't insist in anything; I just said that a server should
have the possibility to add data that have been used, not that it
MUST add data.