Subject: WG Last Call draft-ietf-pkix-SCVP-12.txt

From: "Jim Schaad" <[email-masked]>
Date: Mon, 28 Jul 2003 15:08:01 -0700

ASN.1 Module:
1. CertificateList is not imported
2. UTF8String is not defined
3. OCSPResponse is not imported or defined
4. Name is imported but never referenced
5. SubjectPublicKeyInfo is imported but never referenced

Nits:

Section 1.1: "For a client uses these services" -- "that uses these"
Section 1.1: "that are performed during certification path validation"
-- "certificate path"

Other items:

1. Section 3: References to an SCVPRequest - I assume this should be a
CVRequest

2. Section 3: There is an item called a certValRequest - is this a
CVRequest?

3. Section 3.2.2:  In para 2, there is a parenthetical remark that a
server may choose to perform unrequested operations.  Is this permitted
to affect the result returned to the client?  I.e. I ask for a path
build, the server does revocation checking and the cert is revoked.  Can
it say no valid path exists?

4. Section 3.2.3:  Does AC checking include the PKC checking of the
issuer of the AC?  Can I specify a PKC as a trust point for purposes of
AC path building?

5. Section 3.2.5:  "ask for the servers default validation policy" vs "A
global default validation policy"

6. Section 3.2.5.1, last paragraph:  Yes, but does it match
[email-masked]?  This is a much more interesting question that the
ones you have listed.

7. Section 3.2.5.1:  I want to change from GeneralName to GeneralNames.
I want to be able to specify a name validation for e-mail againist both
a FROM and SENDER name.  I assume that doing two name validation
parameters would NOT get me what I want as both would need to pass
validation. (i.e. AND not OR)

8. Section 3.2.6:  Please add a (small) note dealing with clock skew
issues.

9. Section 3.2.6:  What if I put now into the validateTime field?  How
does the server make the determination on historical information?

10. Section 3.2.7:  Trust anchor only allows for self-signed
certificates?  Can I put an invalid certificate in the trust anchor
locaiton and have it correctly work (i.e. build my own self-signed
certificate to add such items as name constraints)?

11. Section 3.2.8:  I don't like the word trusted in this paragraph.  I
think a better phrase is "considred as valid"  Only items in the trust
anchor list should be considered as "trusted"

12. Section 3.2.9: Allow for references to CRL's to be placed in the
SignedData crl list?

13. Section 3.2.10:  Is it possible to change the term recognize so that
we don't have the same issues that we do with processing certificates
about the difference between recognize and process?

14. Section 3.3: I really don't like having to deal with the fact that
the requestor value must not have a zero octet.  I finally did find the
reason farther down, and would perfer that this be done in the ASN.1
rather than by special processing of the octet string.

15. Section 3.?:  Can a ref be to a extant certificate in a differet
CertRef field?

16. Section 4:  What is an SCVPResponse - no definition, I assume it's a
wrapped ContentInfo w/ a CVResponse, but not defined.

17. Section 4:  If only signed and unsigned responses, why is there an
authenticatedData example below?  [Located text that says signed
responses are either signed or authenticated, I don't like the blurring
between these items as they have different security properties.]

18. Section 4:  Why is there a restriction on the number of SignerInfos?
If a server has two, why can it not sign with both?  How would a server
know which certificate to use for signing?

19. Section 4:  If authenticated data is used, is this only in response
to an authenticated request?  How does the server determine what secret
is to be used?

20. Section 4:  You should permit the inclusion of a CounterSignature
attribute in the unsignedAttrs of a response message for later
processing after archival.

21. Section 4:  Please expand on the following text.  I don't understand
where this identifier would be used.  "   The value of the
message-digest attribute in the signedAttrs within 
   SignerInfo MAY be used as an identifier of the reponse generated by 
   the SCVP server. 
    "

22. Section 4.2: If I ask for a status of a specific time (validityTime)
does this change the value of producedAt?  If so this should be
reminded.

23. Section 4.3:  Please define which items are error vs non-error
response codes.

24. Section 4.4:  Does the connectionless statement imply that if I use
TLS I cannot have two outstanding requests in at a given time?  What
happens for server timeouts, multiple applications using a single pipe
(or impaitent users).

25. Section 4.4:  Please provide guidence on which to use requestHash vs
fullRequest.

26. Section 4.7.5:  Why is ReplyWantBack not using an ANY defined by
field rather than an OCTET STRING?.

27. Question: I put an PKC and and AC cert in a request.  I put in
status-aa-path and status-pkc-path.  What is in the result message?

28. Section B.1:  Why must the item be DER encoded?  Should the CMS
ContentInfo type surround  the CVRequest structure?

29. Section B:  What about the policy messages?

jim