Subject: RE: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]

From: "Trevor Freeman" <[email-masked]>
Date: Fri, 29 Aug 2003 09:53:13 -0700

Steve,
I don't see why the use of AIA is inappropriate for SCVP. It's just a
hint like a lot of other things in certificates such as SKID. If the
client has configured SCVP server it uses, it is free to ignore the
information provided by the AIA, just as client with a locally
configured OCSP server can ignore the OSCP pointer in the AIA extension
today.
Trevor

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Kent
Sent: Thursday, August 28, 2003 6:08 PM
To: Faisal
Cc: Denis Pinkas; [email-masked]
Subject: Re: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]

At 10:24 +0500 8/28/03, Faisal wrote:
>Denis,
>
>- Why is SCVP considered not part of a CA service and
>OCSP is?
>- Where is this defined?
>- Also whether the SCVP service is provided by a CA or provided by some
>other trusted third party, would it still not be a good idea for the CA
>to identify how to locate the responsible SCVP service for its
>certificates (assuming there is one)?
>- Why does it matter who is providing the service?
>
>I don't understand
>
>Regards,
>F a i s a l

OCSP is explicitly an alternative to CRLs, and CRLs are managed by 
CAs. Thus a CA issuing a cert can reasonably choose to insert a 
pointer in AIA to an OCSP server that the CA (or its designee) 
operates, just as it would have inserted a pointer to a repository 
for retrieving CRLs signed by that CA.  In contrast, the choice of an 
SCVP server is a local matter, relative to an RP, and thus it would 
generally be inappropriate for a CA to direct an RP to an SCVP server.

Steve

---

From: Denis Pinkas <[email-masked]>
Date: Fri, 29 Aug 2003 19:04:52 +0200

Trevor,

In my reply to Faisal, there are other arguments which basically support 
Steve's position. We should refrain to include "a lot of other things" in 
public key certificates, otherwise we would open the door to a lot of 
extensions which are not directly related to CAs, like CA best partners, low 
rates for insurances if you have a certificate from that CA, best refinance 
conditions if you have a certificate from that CA, ...

This would look like spam.

Denis

BTW, we are awaiting your explanations (and possibly new text) about the 
differences between the concept of validation policy, as included in RFC 
3379, and the same wording as used in the SCVP draft.