Subject: RE: Open issue: DPV additional information

From: Peter Williams <[email-masked]>
Date: Wed, 17 Apr 2002 15:04:38 -0700

At Mike's suggestion, Ive looked to your mail as a way of exiting
the thread.
 
Im happy  with your (very informal) statement about one important issue, and
agree
that it represents what Denis and the requirements document should be
conveying.
 
Providing that Denisand Russ both agree the DPV requirements entail the
following
matter (informally expressed), I am happy to proceed, on this issue:
 
Without prejudice to other modes of operation, 
a DPV server can use an OCSP response issued by an OCSP
responder that is locally trusted by the DPV client through a validation
policy rule) and that the DPV server will accept the OCSP response on the
client's behalf 
in a manner conforming to the rules of OCSP standard.
 
Given every opportunity to confirm this entailment, todate, Denis
has not done so. With confirmation, we can proceed.

-----Original Message-----
From: Hal Lockhart [mailto:[email-masked]]
Sent: Wednesday, April 17, 2002 10:23 AM
To: 'Michael Myers'; Denis Pinkas; [email-masked]
Cc: pkix
Subject: RE: Open issue: DPV additional information

As entertaining as it is to watch you guys talk past each other, this thread
is getting tiresome. Let me take a crack at why I don't think there is any
real disagreement here.

I think what Denis is saying is that if an entity is a CA, by definition
they are trusted to issue and revoke the certificates they issue, by virture
of being a CA. They can also delegate someone else to do the revocation,
also by virtue of being a CA. If a RP decides to trust their certs, they
must also trust their revocation arrangements.

In contrast, when somebody sets up a DPV server, whether or not they also
run a CA, there is an independant decision to trust the DPV server. It does
not follow as an automatic consequence of the fact thet the same
organization (or key even) may have issued one or more of the certs in the
chain in question.

In other words, a CA may run a DPV server, but the server will be trusted
because RPs choose to do so, not because they have previously chosen to
trust certs issued by the CA.

Everybody agree? ;-) 

Hal 

> -----Original Message----- 
> From: Michael Myers [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> Sent: Wednesday, April 17, 2002 11:22 AM 
> To: Denis Pinkas; [email-masked] 
> Cc: pkix 
> Subject: RE: Open issue: DPV additional information 
> 
> 
> 
> Denis, 
> 
> It is precisely that issue of responsibility, in a broader 
> sense.  I'm quite certain that organizational entities who 
> create, issue and maintain the reliability of public key 
> certificates will will be the first to claim jursidiction 
> regarding their validity. Who is going to claim otherwise? 
> 
> Mike 
> 
> 
> > -----Original Message----- 
> > From: Denis Pinkas [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> > Sent: Wednesday, April 17, 2002 8:02 AM 
> > > Extract from the road map document: 
> > 
> > Certification Authority (CA) - An authority 
> > trusted by one or more users to create and assign 
> > public key certificates. Optionally the CA may 
> > create the user's keys. It is important to 
> > note that the CA is responsible for the public key 
>                       ^^^^^^^^^^^^^^^ 
> > certificates during their whole lifetime, not just 
> > for issuing them. 
>

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 25 Apr 2002 15:12:38 +0200

> Providing that Denis and Russ both agree the DPV requirements entail 
> the following matter (informally expressed), I am happy to proceed, 
> on this issue:
 
> policy rule) 

An "OCSP responder that is locally trusted by the DPV client through a
validation policy rule" does not make sense. An OCSP responder can be
trusted under a given validation policy. If an OCSP responder is locally
trusted by a client, then the DPV server is unaware of it.

In the chain of trust: a validation policy does not know who the clients are
and it is a validation policy issuer that defines which OCSP responders are
trusted, not the clients. It is up to the clients to query DPV servers they
trust and then they will accept whatever is defined in the validation
policy.   

Denis

> and that the DPV server will accept the OCSP response on the
> client's behalf in a manner conforming to the rules of OCSP standard.