Subject: Re: <draft-ietf-pkix-dpv-dpd-req-04.txt>

From: Peter Sylvester <[email-masked]>
Date: Fri, 26 Apr 2002 13:17:54 +0200 (MET DST)

> > >
> > > The client can request that the server determine the certificate
> > > validity at a time other than the current time. The DPV server MUST
> > > obtain revocation status information for the validation time
> > > in the client request.
> > > In order to obtain the revocation status information of any
> > > certificate from the certification path, the DPV server might use, in
> > > accordance with the validation policy, different sources of revocation
> > > information, e.g. a combination of OCSP responses, CRLs, or delta-CRLs.
> > > If the revocation status information for the requested validation time
> > > is unavailable, then the DPV server MUST return a status indicating
> > > that the certificate is invalid.
> 
> > replace by:
> > 
> > The DPV server MUST produce certificate status information for
> > the validation time in the client request. In order to do this,
> > the server might use, in accordance with the validation policy,
> > different sources of external information concerning revocation
> > information, e.g., a combination of OCSP responses, CRLs, or
> > delta-CRLs, or other status information from other DPV servers.
> > 
> > If the certificate status information for the requested validation
> > time is cannot be created, then the DPV server MUST return a status
         XXX                   XXXXX 
> > indicating that the certificate is invalid.
> 
> The last sentence you propose is not English. I simply propose to add to the
> current sentence: "or a response from another DPV server".

This would lead to :
   In order to obtain the revocation status information of any
   certificate from the certification path, the DPV server might use,
   ...
   or a response from another DPV server.

I proposed: 

   The DPV server MUST produce certificate status information for
   the validation time in the client request. In order to do this,
   the DPV server might use,  ...

   or a response from another DPV server.

The first sentence was changed. 

In the seceond paragraph the two words indicated by XX above are indeed
can be deleted. 

> 
> > > The DPV client MUST be able to provide to the validation server,
> > > associated with each certificate to be validated, "useful
> > > certificates", as well as "useful revocation information". Revocation
> > > information includes OCSP responses, CRLs, and delta-CRLs.
> 
> > replace by:
> > 
> > The DPV client MUST be able to provide to the validation server,
> > associated with each certificate to be validated, "useful
> > certificates", as well as "useful information" e.g., revocation
> > information of OCSP responses, CRLs, and delta-CRLs, or status
> > information from other DPV servers.
> 
> No. If there is one DPV answer, then that answer is self-sufficient and
> there is no reason for the client to make another query.

The client does not trust neither the OCSP response, neither the CRls,
neither the DPV server, it presents all these information to *HIS*
server. 

Furthermore DPV responses may concern parts of the certification path.

You might also add 'time stamps' to your list (as in ES-F).

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 26 Apr 2002 16:47:18 +0200

Peter,

> In the seceond paragraph the two words indicated by XX above are indeed

There is no basic diffence between the two proposals. The current changed
text is sufficient. We cannot argue at length on the style of the wording.

> Furthermore DPV responses may concern parts of the certification path.

Validating against one validation policy cert B from the chain (cert B +
cert C) cannot help for validating cert A against a different policy (or
even the same if it could work on a shorter chain) from the chain (cert A +
cert B + cert C). Thus DPV responses on CA certificates would not be
"useful" information. 

> You might also add 'time stamps' to your list (as in ES-F).

As this is only a list of examples, do we need to say so ? As we already
know a DPV response alone will be insufficient for validating a digital
signature. Let us keep the mention of time-stamp tokens when we will address
DSV requirements , ... which is the next step as soon as we finish this
document.

Denis