Subject: RE: One last comment on DPD requirements

From: Stephen Kent <[email-masked]>
Date: Thu, 4 Apr 2002 10:05:12 -0500

At 4:25 PM -0800 4/3/02, Trevor Freeman wrote:
>To state that a client has to be exacting over its specification and
>only wants one chain returned is presupposing the application model.
>There are applications which are more comfortable with making a vague
>request, getting back multiple chains to which they apply their own
>policy. One of the specifications to the server can be find me all paths
>that meet these criteria. I think the simple case on only wanting a
>single chain is the most common so making that the default is fine.

Trevor,

That may a good way to reconcile this issue.  Make single path return 
the default and require support for that by all clients.  Require a 
client that wants multiple paths, and is capable of using them, to 
explicitly enable a multi-path return option, so that only such 
clients receive multiple paths.  Maybe we also could have a return 
code to signal that even though only one path was returned, as per 
the client's (default) request, that other paths are available from 
the server (relative to this request).

Steve

---

From: Ambarish Malpani <[email-masked]>
Date: Thu, 04 Apr 2002 11:06:19 -0800

Steve,
    I think our goal with both DPV and DPD is to simplify the
client. Yes, we can all come up with outlying cases where the
only way to make things work is to return multiple paths - but
if 99% of the clients don't care about those configurations/cases,
why should we address them in DPV/DPD?

Let's make things easier for the majority of apps. If an app wants
to deal with a really complicated PKI - let them do their own
path gathering and validation.

Makes sense?

Ambarish

---------------------------------------------------------------------
Ambarish Malpani
Chief Architect                                          650.567.5457
ValiCert, Inc.                                  [email-masked]
1215 Terra Bella Ave.                         http://www.valicert.com
Mountain View, CA 94043

> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]
> Sent: Thursday, April 04, 2002 2:35 AM
> To: [email-masked]
> Subject: Re: One last comment on DPD requirements
> 
> 
> 
> 
> And adding another reason: multiple paths may exist which only 
> really differ in their validity fields. Unless the requirements
> call for a pretty complex time specifier in the request the 
> simplest thing is for the server to send back all such paths
> found and let the client sort it out (i.e. even if the client 
> picks a single point in time, there may still be >1 path such 
> that the paths only differ in validity; to close this down some 
> fairly hairy time specifier in the request would have to be
> defined and no clients would bother filling that in properly
> in any case).
> 
> Stephen.
> 
> Santosh Chokhani wrote:
> > 
> > Russ:
> > 
> > I agree with you, but for a different reason.  I do not 
> think this is
> > application specific issue.  I think it is the path 
> validation issue.  I
> > do not think that the DPD server can know which paths are 
> good without
> > doing a validation also, specially to see if there will be any name
> > constraints or certificate policy related failures.
> > 
> > -----Original Message-----
> > From: [email-masked] 
> [mailto:[email-masked]]
> > On Behalf Of Housley, Russ
> > Sent: Wednesday, April 03, 2002 2:12 PM
> > To: Ambarish Malpani; Stephen Kent
> > Cc: [email-masked]
> > Subject: Re: One last comment on DPD requirements
> > 
> > Steve & Ambarish:
> > 
> > >>Hi Group,
> > >>     One last (slightly late) comment on the DPD 
> requirements that has
> > 
> > >>been troubling me:
> > >>
> > >>In the DPD requirements, there is a reasonable amount of text that
> > >>talks about how a server can return multiple paths back 
> to the client
> > >>(to allow the client to decide which path is the best).
> > >>
> > >>The main goal of DPD is to try and simplify the client. 
> In how many
> > >>cases do people really want multiple paths back from the 
> server. While
> > 
> > >>it is the right requirement in principal, do folks really think
> > >>clients will want multiple paths back from a DPD server? 
> Are we adding
> > 
> > >>the additional flexiblity/complexity just for technical purity?
> > >>
> > >>Comments will be appreciated.
> > >>
> > >>Regards,
> > >>Ambarish
> > >
> > >I too would favor simplifying the protocol requirement 
> here. Some folks
> > >have suggested motivations for multiple paths, but this 
> does seem to
> > >conflict with the fundamental goal of creating a protocol 
> to satisfy
> > the
> > >needs of thin clients.
> > >
> > >Steve
> > 
> > I agree with your goal.  It is far better for the client to tell the
> > server
> > what it wants, then get back a single path that satisfies all of the
> > requirements.  To do this, we need to be able to fully specify the
> > clients
> > criteria and send them to the server.  I think that we know 
> how to do
> > this
> > for many PKI-enabled applications, but I am not sure that 
> we know how to
> > do
> > it for all applications, especially ones that are yet to be 
> developed.
> > 
> > This leaves us with two choices.  Either the protocol 
> returns multiple
> > certification paths (the approach in the current document) or the
> > protocol
> > requires the client to adequately specify its criteria.  
> This could be
> > done
> > with the path discovery policy.  If we adopt this 
> alternative, we should
> > 
> > include additional text so that implements expect 
> application-specific
> > (perhaps several application-specific path discovery policy 
> if there are
> > 
> > multiple roles in the application).
> > 
> > Russ
> 
> -- 
> ____________________________________________________________
> Stephen Farrell         				   
> Baltimore Technologies,   tel: (direct line) +353 1 881 6716
> 39 Parkgate Street,                     fax: +353 1 881 7000
> Dublin 8.                mailto:[email-masked]
> Ireland                             http://www.baltimore.com
>

---

From: "Trevor Freeman" <[email-masked]>
Date: Thu, 4 Apr 2002 14:52:07 -0800

Hi Steve,
I agree having the server return a flag if there are more chains
available if the client only requested a single chain be returned makes
sense.
Trevor
-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Thursday, April 04, 2002 7:05 AM
To: Trevor Freeman
Cc: [email-masked]
Subject: RE: One last comment on DPD requirements

At 4:25 PM -0800 4/3/02, Trevor Freeman wrote:
>policy. One of the specifications to the server can be find me all 
>paths that meet these criteria. I think the simple case on only wanting

>a single chain is the most common so making that the default is fine.

Trevor,

Steve