Subject: RE: Open issue: DPV relay

From: Peter Williams <[email-masked]>
Date: Mon, 15 Apr 2002 10:40:52 -0700

Denis:

In your phrase "authorised CRL issuers or authorised OCSP 
responders", who performs the act of authorization?

Which mechanism(s) of OCSP communicate
and handle "authorization", for the OCSP case?

Who is responsible for "enforcing" the authorization
policy, of the authorization scheme, for the OCSP case?

Which procedures of the (to be specified) DPV Protocol
will perform the requirements for authorization
enforcement for DPV? And the interaction of DPV
with CRL issuers and OCSP responders, and any
other repository access provider.

When a DPV relay server receives an OCSP response
set from the upstream DPV relay, will it
(a) forward the OCSP responses to the client?
(b) reverify the OCSP responses, before sending material
to the client?
(c) take legal responsibility for the upstream
validation policy enforcement?

How will the DPV relay server know if the
OCSP responder upstream (several DPV relay
servers away) is "authorized"?

If a DPV server relays a DPV request, and
authorization is issued by the relying party,
how will an upstream DPV server enforce
the policy - without knowledge of
the relying party identity, and the
validation policy.

>>>>-----Original Message-----
>>>>From: Denis Pinkas [mailto:[email-masked]]
>>>>Sent: Monday, April 15, 2002 12:49 AM
>>>>To: Peter Sylvester
>>>>Cc: [email-masked]
>>>>Subject: Re: Open issue: DPV relay
>>>>
>>>>The DPV request MUST allow the client to request the response to 
>>>>include either the certification path and the revocation status 
>>>>information from authorised CRL issuers or authorised OCSP 
>>>>responders, 
>>>>or a DPV response from a DPV server that is trusted under the 
>>>>validation policy. This information may allow other clients, not 
>>>>trusting the requested DPV server to be confident that the 
>>>>certificate 
>>>>validation has correctly be performed. When the certificate 
>>>>is valid 
>>>>according to the validation policy, the server MUST, upon request, 
>>>>include that information in the response. However, the server MAY 
>>>>omit that information when the certificate is invalid or when it 
>>>>cannot determine the validity.

---

From: Denis Pinkas <[email-masked]>
Date: Tue, 16 Apr 2002 10:01:33 +0200

Peter,

> responders", who performs the act of authorization?

Many questions and simple answers.

Authorized means authorized by the CA that has issued the certificate.
Authorized CRL Issuers and authorized OCSP responders are designated by the
CA.

> and handle "authorization", for the OCSP case?

A certificate is issued by the CA for the OCSP responder.

> policy, of the authorization scheme, for the OCSP case?

The CA that has issued the certificate.

> other repository access provider.

Certificates issued by the CA for the CRL Issuers and OCSP responders will
do it.
 
> validation policy enforcement?

A DPV server does not simply send back an OCSP response, but a DPV response
which *may* be accompanied with certificates, CRLs and OCSP responses, *all*
verified.
 
> servers away) is "authorized"?

See above.
 
> authorization is issued by the relying party,

Authorisation comes from a CA, not from a relying party.

> the relying party identity, and the

The validation policy has to be known from a DPV server.

Denis