Subject: RE: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]

From: "Trevor Freeman" <[email-masked]>
Date: Fri, 29 Aug 2003 11:13:38 -0700

Denis,
The question of what is or is not useful information is down to your
point of view. Just because you don't value it, does not mean others
will view it likewise.
Trevor

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Friday, August 29, 2003 10:05 AM
To: Trevor Freeman
Cc: Stephen Kent; Faisal; [email-masked]
Subject: Re: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]

Trevor,

In my reply to Faisal, there are other arguments which basically support

Steve's position. We should refrain to include "a lot of other things"
in 
public key certificates, otherwise we would open the door to a lot of 
extensions which are not directly related to CAs, like CA best partners,
low 
rates for insurances if you have a certificate from that CA, best
refinance 
conditions if you have a certificate from that CA, ...

This would look like spam.

Denis

BTW, we are awaiting your explanations (and possibly new text) about the

differences between the concept of validation policy, as included in RFC

3379, and the same wording as used in the SCVP draft.

> Steve,
> I don't see why the use of AIA is inappropriate for SCVP. It's just a
> hint like a lot of other things in certificates such as SKID. If the
> client has configured SCVP server it uses, it is free to ignore the
> information provided by the AIA, just as client with a locally
> configured OCSP server can ignore the OSCP pointer in the AIA
extension
> today.
> Trevor
> 
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Stephen Kent
> Sent: Thursday, August 28, 2003 6:08 PM
> To: Faisal
> Cc: Denis Pinkas; [email-masked]
> Subject: Re: I-D ACTION:draft-deacon-xkms-aia-00.txt [SCVP-AIA]
> 
> 
> At 10:24 +0500 8/28/03, Faisal wrote:
> 
>>Denis,
>>
>>- Why is SCVP considered not part of a CA service and
>>OCSP is?
>>- Where is this defined?
>>- Also whether the SCVP service is provided by a CA or provided by
some
>>other trusted third party, would it still not be a good idea for the
CA
>>to identify how to locate the responsible SCVP service for its
>>certificates (assuming there is one)?
>>- Why does it matter who is providing the service?
>>
>>I don't understand
>>
>>Regards,
>>F a i s a l
> 
> 
> OCSP is explicitly an alternative to CRLs, and CRLs are managed by 
> CAs. Thus a CA issuing a cert can reasonably choose to insert a 
> pointer in AIA to an OCSP server that the CA (or its designee) 
> operates, just as it would have inserted a pointer to a repository 
> for retrieving CRLs signed by that CA.  In contrast, the choice of an 
> SCVP server is a local matter, relative to an RP, and thus it would 
> generally be inappropriate for a CA to direct an RP to an SCVP server.
> 
> Steve
>

---

From: "Michael Myers" <[email-masked]>
Date: Fri, 29 Aug 2003 12:33:36 -0700

If WG poll was called on the above subject, I would vote in
favor of its definition.

Michael Myers
(602) 739-7744

> [mailto:[email-masked]]On Behalf Of
> Trevor Freeman
> Sent: Friday, August 29, 2003 11:14 AM
> To: Denis Pinkas
> Subject: RE: I-D ACTION:draft-deacon-xkms-aia-00.txt
> [SCVP-AIA]
>
>
>
> Denis,