Subject: Re: FW: scvp

From: Peter Sylvester <[email-masked]>
Date: Fri, 23 Apr 2004 20:18:35 +0200 (MEST)

in version 13 the syntax for a Query has been changed from

   Query ::= SEQUENCE { 
       queriedCerts          SEQUENCE SIZE (1..MAX) OF CertReference, 
       checks                CertChecks, 
       wantBack              WantBack, 
       serverContextInfo [0] OCTET STRING OPTIONAL, 
       valPolicy         [1] ValidationPolicy OPTIONAL, 
       validityTime      [2] GeneralizedTime OPTIONAL, 
       trustAnchors      [3] TrustAnchors OPTIONAL, 
       intermediateCerts [4] CertBundle OPTIONAL, 
       revInfos          [5] RevocationInfos OPTIONAL, 
       queryExtensions   [6] Extensions OPTIONAL } 
    
to  

    Query ::= SEQUENCE { 
      queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference, 
      checks                  CertChecks, 
      wantBack                WantBack, 
      requestRefHash          BOOLEAN DEFAULT TRUE, 
      includePolResponce      BOOLEAN DEFAULT FALSE, 
      inhibitPolMap           BOOLEAN DEFAULT FALSE, 
      requireExplicitPol      BOOLEAN DEFAULT FALSE, 
      ignoreAnyPol            BOOLEAN DEFAULT FALSE, 
      valAlgorithm            ValidationAlgorithm, 
      serverContextInfo   [0] OCTET STRING OPTIONAL, 
      validityTime        [1] GeneralizedTime OPTIONAL, 
      trustAnchors        [2] TrustAnchors OPTIONAL, 
      intermediateCerts   [3] CertBundle OPTIONAL, 
      revInfos            [4] RevocationInfos OPTIONAL, 
      queryExtensions     [5] Extensions OPTIONAL } 

I am not sure whether I am the only person unable to construct a parser.

in version 14 an aditional flag has been added which is not available in the
Chapter 9. Is the isCA flag an orthogonal attribut to other validation
algorithms, or just to some of them, e.g,. the default name matching one? 

    Query ::= SEQUENCE { 
      queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference, 
      checks                  CertChecks, 
      wantBack                WantBack, 
      requestRefHash          BOOLEAN DEFAULT TRUE, 
      includePolResponce      BOOLEAN DEFAULT FALSE, 
      inhibitPolMap           BOOLEAN DEFAULT FALSE, 
      requireExplicitPol      BOOLEAN DEFAULT FALSE, 
      ignoreAnyPol            BOOLEAN DEFAULT FALSE, 
      isCA                    BOOLEAN DEFAULT FALSE, 
      valAlgorithm            ValidationAlgorithm, 
      serverContextInfo   [0] OCTET STRING OPTIONAL, 
      validityTime        [1] GeneralizedTime OPTIONAL, 
      trustAnchors        [2] TrustAnchors OPTIONAL, 
      intermediateCerts   [3] CertBundle OPTIONAL, 
      revInfos            [4] RevocationInfos OPTIONAL, 
      keyUsage            [5] KeyUsage OPTIONAL, 
      extendedKeyUsage    [6] ExtKeyUsageSyntax OPTIONAL, 
      queryExtensions     [7] Extensions OPTIONAL  
      producedAt          [8] GeneralizedTime OPTIONAL}

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 26 Apr 2004 10:09:09 +0200

Peter and Trevor,

I have major problems too.

>        queryExtensions   [6] Extensions OPTIONAL } 

In this structure trustAnchors was more or less an alternative to valPolicy.

In fact, IF the valPolicy is the default policy, THEN additional parameters 
MUST be provided. So the structure below does not fit as well.

This leads to have the two following elements:

     valPolicy               ValidationPolicy,
     paramsDefValPolicy      ParamsDefValPolicy OPTIONAL,

where the first one is mandatory and the second one optional.

>       queryExtensions     [5] Extensions OPTIONAL } 

I would thus propose to have something like:

Query ::= SEQUENCE {
         queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference,
         checks                  CertChecks,
         wantBack                WantBack,
         requestRefHash          BOOLEAN DEFAULT TRUE,
         serverContextInfo       OCTET STRING OPTIONAL,
         validityTime            GeneralizedTime OPTIONAL,
         includePolResponse      BOOLEAN DEFAULT FALSE,
         valPolicy               ValidationPolicy,
         paramsDefValPolicy  [0] ParamsDefValPolicy OPTIONAL,
         intermediateCerts   [1] CertBundle OPTIONAL,
         revInfos            [2] RevocationInfos OPTIONAL,
         queryExtensions     [3] Extensions OPTIONAL }

and then something like:

    ParamsDefValPolicy :: = SEQUENCE {
        trustAnchors                  TrustAnchors,
        endEntityCertificationPolicy  SEQUENCE OF OBJECT IDENTIFIER OPTIONAL,
        inhibitPolMap                 BOOLEAN DEFAULT FALSE,
        caCertificationPolicies       SEQUENCE OF OBJECT IDENTIFIER OPTIONAL }

Denis