Subject: RE: FW: scvp

From: "Trevor Freeman" <[email-masked]>
Date: Mon, 26 Apr 2004 23:29:20 -0700

Hi Peter,
The additions optional allow the client to specify in the request the
full range validation parameters defined in 3280 section 6. If you read
section 1, you will see a validation policy is the validation algorithm
plus the input parameter to the algorithm. SCVP14 defines all the base
inputs as defined in 3280. New validation algorithm cab define
additional input variable.
The only other parameter you mention refers to Basic constraints, so if
a SCVP client want to validate what it believes is a CA certificate,
then it passes in CA=true.

Trevor

-----Original Message-----
From: Peter Sylvester [mailto:[email-masked]] 
Sent: Friday, April 23, 2004 11:19 AM
To: [email-masked]; Trevor Freeman
Cc: [email-masked]
Subject: Re: FW: scvp

in version 13 the syntax for a Query has been changed from

   Query ::= SEQUENCE { 
       queriedCerts          SEQUENCE SIZE (1..MAX) OF CertReference, 
       checks                CertChecks, 
       wantBack              WantBack, 
       serverContextInfo [0] OCTET STRING OPTIONAL, 
       valPolicy         [1] ValidationPolicy OPTIONAL, 
       validityTime      [2] GeneralizedTime OPTIONAL, 
       trustAnchors      [3] TrustAnchors OPTIONAL, 
       intermediateCerts [4] CertBundle OPTIONAL, 
       revInfos          [5] RevocationInfos OPTIONAL, 
       queryExtensions   [6] Extensions OPTIONAL } 
    
to  

    Query ::= SEQUENCE { 
      queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference, 
      checks                  CertChecks, 
      wantBack                WantBack, 
      requestRefHash          BOOLEAN DEFAULT TRUE, 
      includePolResponce      BOOLEAN DEFAULT FALSE, 
      inhibitPolMap           BOOLEAN DEFAULT FALSE, 
      requireExplicitPol      BOOLEAN DEFAULT FALSE, 
      ignoreAnyPol            BOOLEAN DEFAULT FALSE, 
      valAlgorithm            ValidationAlgorithm, 
      serverContextInfo   [0] OCTET STRING OPTIONAL, 
      validityTime        [1] GeneralizedTime OPTIONAL, 
      trustAnchors        [2] TrustAnchors OPTIONAL, 
      intermediateCerts   [3] CertBundle OPTIONAL, 
      revInfos            [4] RevocationInfos OPTIONAL, 
      queryExtensions     [5] Extensions OPTIONAL } 

I am not sure whether I am the only person unable to construct a parser.

in version 14 an aditional flag has been added which is not available in
the
Chapter 9. Is the isCA flag an orthogonal attribut to other validation
algorithms, or just to some of them, e.g,. the default name matching
one? 

    Query ::= SEQUENCE { 
      queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference, 
      checks                  CertChecks, 
      wantBack                WantBack, 
      requestRefHash          BOOLEAN DEFAULT TRUE, 
      includePolResponce      BOOLEAN DEFAULT FALSE, 
      inhibitPolMap           BOOLEAN DEFAULT FALSE, 
      requireExplicitPol      BOOLEAN DEFAULT FALSE, 
      ignoreAnyPol            BOOLEAN DEFAULT FALSE, 
      isCA                    BOOLEAN DEFAULT FALSE, 
      valAlgorithm            ValidationAlgorithm, 
      serverContextInfo   [0] OCTET STRING OPTIONAL, 
      validityTime        [1] GeneralizedTime OPTIONAL, 
      trustAnchors        [2] TrustAnchors OPTIONAL, 
      intermediateCerts   [3] CertBundle OPTIONAL, 
      revInfos            [4] RevocationInfos OPTIONAL, 
      keyUsage            [5] KeyUsage OPTIONAL, 
      extendedKeyUsage    [6] ExtKeyUsageSyntax OPTIONAL, 
      queryExtensions     [7] Extensions OPTIONAL  
      producedAt          [8] GeneralizedTime OPTIONAL}