Subject: RE: One last comment on DPD requirements

From: "Trevor Freeman" <[email-masked]>
Date: Wed, 3 Apr 2002 16:25:55 -0800

To state that a client has to be exacting over its specification and
only wants one chain returned is presupposing the application model.
There are applications which are more comfortable with making a vague
request, getting back multiple chains to which they apply their own
policy. One of the specifications to the server can be find me all paths
that meet these criteria. I think the simple case on only wanting a
single chain is the most common so making that the default is fine.

-----Original Message-----
From: Housley, Russ [mailto:[email-masked]] 
Sent: Wednesday, April 03, 2002 11:12 AM
To: Ambarish Malpani; Stephen Kent
Cc: [email-masked]
Subject: Re: One last comment on DPD requirements

Steve & Ambarish:

>>Hi Group,
>>     One last (slightly late) comment on the DPD requirements that
>>has been troubling me:
>>
>>In the DPD requirements, there is a reasonable amount of text that
>>talks about how a server can return multiple paths back to the
>>client (to allow the client to decide which path is the best).
>>
>>The main goal of DPD is to try and simplify the client. In how many
>>cases do people really want multiple paths back from the server.
>>While it is the right requirement in principal, do folks really
>>think clients will want multiple paths back from a DPD server? Are
>>we adding the additional flexiblity/complexity just for
>>technical purity?
>>
>>Comments will be appreciated.
>>
>>Regards,
>>Ambarish
>
>I too would favor simplifying the protocol requirement here. Some folks

>have suggested motivations for multiple paths, but this does seem to 
>conflict with the fundamental goal of creating a protocol to satisfy
the 
>needs of thin clients.
>Steve

I agree with your goal.  It is far better for the client to tell the
server 
what it wants, then get back a single path that satisfies all of the 
requirements.  To do this, we need to be able to fully specify the
clients 
criteria and send them to the server.  I think that we know how to do
this 
for many PKI-enabled applications, but I am not sure that we know how to
do 
it for all applications, especially ones that are yet to be developed.

This leaves us with two choices.  Either the protocol returns multiple 
certification paths (the approach in the current document) or the
protocol 
requires the client to adequately specify its criteria.  This could be
done 
with the path discovery policy.  If we adopt this alternative, we should

include additional text so that implements expect application-specific 
(perhaps several application-specific path discovery policy if there are

multiple roles in the application).

Russ

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 04 Apr 2002 15:35:29 +0200

Trevor,

I agree with you.

The current text states that some forms of path discovery policy can be
simple. This is because rough selection criteria can be set for DPD, 
while more precise are needed for DPV. It does make sense to return multiple
path, if specifially requested.

Denis