Subject: RE: Signing Untrusted SCVP?

From: "Dave Engberg" <[email-masked]>
Date: Mon, 5 Apr 2004 12:17:18 -0400

Stephen -

I assume that the "From" address in my email message makes it pretty
up-front what company I work for.  I actually have a strong preference
AGAINST pre-signing (or any kind of signing) for DPD responses, which is
the opposite of CoreStreet's preferred approach to OCSP.  To be less
circumspect about my motives:  I am interested in DPD and DPV, but
believe that SCVP DPV is a gigantic step backward for PKI security, and
want to figure out whether SCVP DPD can be tweaked to support large
(multi-million-user) environments with hundreds of DPD servers around
the world on public networks.  If so, CoreStreet may consider product
development in this area, probably without a pregeneration approach.

Anyhoo ... my preference is your second option.  Allow SCVP servers to
be deployed by environments that only use DPD, without requiring that
those servers protect any private keys "just in case".  This is the same
as allowing some CAs to distribute CRLs only via LDAP or HTTP
directories that don't implement SSL.  This avoids "over PKIing" the
SCVP DPD protocol just to slightly mitigate one minor and baroque type
of DoS.

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Monday, April 05, 2004 11:41 AM
To: Dave Engberg
Cc: [email-masked]
Subject: RE: Signing Untrusted SCVP?

...

	- the pre-generation issue is what I bet is your major concern,
consistent with you company's model for OCSP, and your should have been
more up front about that in your first message

...

RFC 3379 (2002) established requirements for DPD and said that
authenticated  requests and responses MAY be required. So, that RFC does
not mandate integrity and authenticity for these exchanges, and it
explicitly allows for use of lower layer mechanisms to provide these
services.

So, we could mandate that DPD servers support signed requests and
responses, and allow local users and admins to choose whether to invoke
the feature, or we make it an optional aspect of implementations.  I do
worry that the latter approach will result in depriving clients of the
option, due to the sort of marketplace pressures that became evident in
our discussion of pre-generated OCSP responses.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Mon, 5 Apr 2004 13:57:46 -0400

At 12:17 PM -0400 4/5/04, Dave Engberg wrote:
>up-front what company I work for.

yes, but I don't assume an employee necessarily agrees with all of 
his/her employer's technical positions, and IETF policy argues that 
one ought not make such assumptions.

>I actually have a strong preference
>the opposite of CoreStreet's preferred approach to OCSP.

I'm surprised by that assertion, given your comment in the previous 
message that pre-signed responses were a problem if we require 
signed, nonced (pardon the neologism) responses for DVD. if you are 
not a fan of pre-signed responses, I would not have expected you to 
cite that concern, nor raise the related issue of the cost of an 
expensive crypto module. But, I'll take your word that these 
arguments, which seem to be motivated by a preference for 
pre-signing, are not really representative of your personal views.

>To be less
>believe that SCVP DPV is a gigantic step backward for PKI security,

What parts of the rationale in 3379 for DPV do you not believe are true?

>and

Well, at least we agree on a resolution to the issue.

Steve