Subject: Re: FW: scvp

From: Peter Sylvester <[email-masked]>
Date: Mon, 26 Apr 2004 14:19:02 +0200 (MEST)

> 
> Your question makes sense. The default validation algorithm is too simple 
> and does not make any difference bewteen the CP appropriate for the 
> end-entity certificate (i.e. endEntityCertificationPolicy) and the CP 
> appropriate for the CA certificates (i.e. caCertificationPolicies).
Where do you need such a difference?
> 
> So these two parameters make one only for the default validation policy. It 
> however obvious that more elaborate validation policies would be able to 
> make the difference.

I am not sure that I follow you here.  Can't you always cover different 
certification policies using policy mappings? 

> This raises me an observation. The parameters for a given CP should be 
> depended upon the OID of the validation policy.

What parameters of a given CP? Addresses of a validation service, url for
cert lookup?  

> 
> This means that a better (and much simpler) structure would be:
> 
> Query ::= SEQUENCE {
>          queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference,
>          checks                  CertChecks,
>          wantBack                WantBack,
>          requestRefHash          BOOLEAN DEFAULT TRUE,
>          serverContextInfo       OCTET STRING OPTIONAL,
>          validityTime            GeneralizedTime OPTIONAL,
>          includePolResponse      BOOLEAN DEFAULT FALSE,
>          valPolicy               ValidationPolicy,
>          intermediateCerts   [0] CertBundle OPTIONAL,
>          revInfos            [1] RevocationInfos OPTIONAL,
>          queryExtensions     [2] Extensions OPTIONAL }
> 
> with:
> 
>     ValidationPolicy  ::=  SEQUENCE  {
>          algorithm               OBJECT IDENTIFIER,
>          parameters              ANY DEFINED BY algorithm OPTIONAL  }
> 
> Then the parameters of the default validation policy should be defined.

Why is the following an independant booloan and not a WantBack?
          includePolResponse      BOOLEAN DEFAULT FALSE.

Why are intermediate certs  and revocationInformation independant
of the validation policy but trustanchors are not?

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 26 Apr 2004 14:38:13 +0200

Peter,

> Where do you need such a difference?

A signatory certificate in Europe may use a specific OID for the CP meaning 
"Qualified Certificate".

Such CP does not apply to CA certificates.

> certification policies using policy mappings? 

No. Policy mappings make mapping in any category.

> What parameters of a given CP? Addresses of a validation service, url for

Ooops ! This is a typo. I meant: The parameters for a given *validation 
policy* should be depended upon the OID of the validation policy.

> of the validation policy but trustanchors are not? 

intermediate certs and revocationInformation is just "useful" information 
that may be used or discarded.

Denis