Subject: raodmap

From: Peter Sylvester <[email-masked]>
Date: Wed, 17 Apr 2002 18:29:30 +0200 (MET DST)

The roadmap draft contains the following text:

   Another long debated topic in the WG dealt with certificate 
   revocation. Numerous drafts have been developed to address different 
   issues related certificate revocations. CMP supports revocation 
   request, response, revocation announcement, and requests for CRL 
   messages. CMC defines revocation request, revocation response, and 
   requests for CRL messages, but uses CMS as the encapsulating 
   protocol. [OCSP] was developed to address concerns that not all 
   relying parties want to go through the process checking CRLs from 
   every CA in the certification path. It defines an on-line mechanism 
   to determine the status of a given certificate, which may provide 
   more timely revocation information than is possible with CRLs. The 
   Simple Certification Verification Protocol (SCVP) was produced to 
   allow relying parties to off-load all of their certification 
   verification to another entity [SCVP]. The WG was arguably split over 
   whether such a function should be supported and whether it should be 
   its own protocol or included in OCSP. In response, a draft defining 
   OCSP Extensions was produced to include the functions of SCVP. [OCSP] 
   has been a draft standard for more than six months and is in the 
   process of being revised [OCSPv2]. To capture the work from the OCSP 
   Extensions, two drafts were developed: Delegated Path Validation 
   [DPV] and Delegated Path Discovery [DPD]. After considerable debate, 
   the WG selected SCVP as the PKIX protocol for delegated path 
   validation and delegated path discovery. A requirements document has 
   been developed, and is currently under WG review. [DPREQ] Upon 
   completion of [DPREQ], the SCVP protocol will be completed. 

I am somewhat surprised about this vision of online status protocol
history and future. 

1 - Since its initial draft in June 4 1998, DVCS has always included
certificate validation as one it its service. 

2 - At the time when OCSP was discussed DVCS was already mentioned
as a protocol to provide certificate 'positive' status information. 

1 - The first drafts of SCVP was produced June 25, 1999. At that time
the first notary draft from Carlisle was already more than one year old. 
and DCS and DVCS have always included the function of validation of
a public key certificate. 

3 - Does someone can tell me in which meeting or decision the working
group 'selected' SCVP as the PKIX protocol? Was this a reaction of
some information that OCSP-V2 was somehow considered abandoned?

4 - As far as I know, and as far as it is regularily reminded by
the editors of the requirements drafts, we are not yet talking about
a particular protocol. Why is there a statement that SCVP will be 
completed?

Peter.