Subject: Re: Open issue: DPV additional information

From: Peter Sylvester <[email-masked]>
Date: Tue, 16 Apr 2002 17:19:50 +0200 (MET DST)

> Peter,
> 
> We need to agree on a common text. So, please focuss on the text.
> 
> Since you made no proposal, but only provided a "hint", what about the new
> text below ?
I am not sure whether your intend is to give a complete list of all possibilities,
or just an example of what can currently be considered as possible
responses. If it is the latter, that's ok. 

To avoid some misunderstanding , I propose: 

.. Such information may (not necessarily exclusively) consist of a certification path ...

---

From: Peter Sylvester <[email-masked]>
Date: Thu, 18 Apr 2002 21:13:47 +0200 (MET DST)

> Currently, there are assumed models and/or
> statements about the relationships. If
> they stay, they must become more coherent.
> 
> Currently a DPV server is a mystical NR-supporting
> server (Denis), that (somehow) will enforce a CA 
> authorization over CRL and OCSP issuers (Denis), but
> will itself will not be authorized by a CA (Denis), but
> the service may be provided by a CA using a CAs cert/CRL
> signing key (Mike) that uses validation policies of 
> unknown rules (not limited to trust-anchors and X.509 path
> processing parameters) to indicate to a relying party
> that a given chain is valid under the policy, and will
> supply its sources of asurnace (certs, CRLS, OCSP responses) to the RP to
> maintain
> as evidence alongside the DPV response.
> 
> And somewhere in all this, there is something
> about signature policies.

Is this so mystical? One could also resume some functions of DPV like:

A DPV server is a Trusted Third Party (TTP) providing a validation
service, asserting validity of public key certificates.
As a result of the validation, a DPV generates a DPV attestation.

The DPV attestation can be used for constructing evidence of 
non-repudiation related to the validity of an entity's public
key certificate. 

The presence of a DPV attestation supports non-repudiation by providing 
evidence that a public key certificate was valid at the time indicated in
the DPV attestation.

A DPV response can for example be used even after the public key certificate
expires and its revocation information is no longer or not easily available.