Subject: Re: Open issue: DPV relay

From: Peter Sylvester <[email-masked]>
Date: Wed, 10 Apr 2002 17:10:04 +0200 (MET DST)

> 
> Peter,
> 
> (text deleted)
> 
> > I refer to my proposal to change the text saying that
> > that among the optional returned infos like paths CRL,
> > OCSP responses, there may alos occur DPV responses.
> 
> I would disagree. Let me explain why. The requester only trusts the DPV
> server that it has queried. The DPV server may trust any server it likes,
> but the client does not care: the client does not necessarilly trust them. 
> The original server is the only one responsible for the "valid" signed 
> response. So if a DPV response from another server were included as a proof 
> of the "valid" response, it would not be a proof for the client. The client
> needs a proof from first hand, i.e. a proof that is not disputable. This can
> only be the original certification path, the original CRLs and the original
> OCSP responses, with all the proofs that the CRL Issuers and the OCSP
> responders are indeed empowered to provide that information.

I disagree when you say 'this can *only* be'. You assume implicitly that
the only service providable by CAs are CRLs and/or OCSP. So far,
DPV has been designed in a way that instead of providing an OCSP service
through whatever structure, a CA can provide a quite similar service
using DPV. 
  
> > Encapsulating a "DPV response" in a OCSP response still
> > remains an option anyway.
> 
> Encapsulating a "DPV response" in a OCSP response is out of the scope of
> this discussion.
I am not discussing this, I just reminded that in order to formally
respond to the actual text, it is always possible to create
an OCSP response together with an indication about the existance
of the cert, and one may or not call this *DPV* response. 
Or: If one would take the DPV proposal of OCSP-V2 as a potential
implementation there would be conformance of 'only OCSP responses'
and at the same time there would be DPV reponses. 

> > Since you haven't commented the next paragraph may I assume that
> > this is ok with you?
> 
> > > > I think the general principle should be that there is one mode
> > > > that all information essential to understand what has contributed
> > > > to the final decision must be made available to the client.
> > > > (Not necessarily understood by the client).
> 
> No. It is always necessary to provide a yes/no/unknown answer (or an error).
> It is optional to provide all the information essential to test again the
> certificate validity, should another party not simply trust the signed "yes"
> answer. It is certainly not necessary for the client to understand what has
> contributed to the final decision. 

What is 'no': 

Where did I say that yes/no/unknown is NOT necessary? (is this the reason
for the no?) In the remainder you just rephrase what I have said. 

'it is optional'  == "there is one mode"
'all the information essential'  idem
'Not necessarily understood by the client'  == last sentence. 

> 
> Denis
> 
> > > > I would also agree, that only necessary information should be made
> > > > available. It may be not necessary to inform:
> > > >
> > > > - Yesterday I have made three unsuccesseful attempt at time1 2 3,
> > > >   the last one finally succeed by using an internet connect to
> > > >   address a.b.c.d using DPV protocol over OCSP, ...
> > > >
> > > > Peter
>

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 10 Apr 2002 17:41:22 +0200

Peter,

> through whatever structure, a CA can provide a quite similar service

I now understand why we disagree.

This service does *not* need to be provided by a CA. It can be provided by
any service provider that the client is willing to trust. The case where it
would be provided by a CA, would be a very specific case. In order to
resolve disputes, the "proof" must directly come from the CAs. This means
that CRLs as well as OCSP responses must be provided by CAs (or authorities
empowered by the CAs). DPV responses would be of no value.

> of the cert, and one may or not call this *DPV* response.

Certainly not. The full path is being checked, not a single certificate.

> and at the same time there would be DPV reponses.

There is no more a standing OCSP-v2 proposal today.

> > contributed to the final decision.

It is *not* necessary for the client to gather all the information that has
contributed to the final decision; i.e. relayed DPV responses, if any, are
not needed.

> for the no?) In the remainder you just rephrase what I have said.

With a *not*, which makes a big difference.

In case of a dispute, testing again the certificate validity, means that
certificates, CRLs and OCSP responses must be available. Anything else is
useless.

Denis.

---

From: "Michael Myers" <[email-masked]>
Date: Wed, 10 Apr 2002 11:42:16 -0700

All,

Once the requirements settle down, we intend to update the
OCSPv2 I-D accordingly for the WG's consideration.  It made no
sense to produce incremental I-Ds until then.  Now that we're
about a year into the rqmts, I suspect we're near closure on
that issue.

Mike

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Denis Pinkas
>
>