Subject: RE: Signing Untrusted SCVP?

From: "Dave Engberg" <[email-masked]>
Date: Mon, 12 Apr 2004 17:30:48 -0400

I assumed that "MUST be capable of" meant that every running server
instance itself must have the ability to perform signatures.  If the
correct interpretation for "capable of" is that the software product has
the capability, but some instances may not deploy with this feature,
then this sounds good to me.

In short, yes.

-----Original Message-----
From: Michael Myers
Sent: Sat, 10 Apr 2004 15:24:18 -0700
Subject: RE: Signing Untrusted SCVP?

My opinion is that as long as DPD-only servers are capable of signing
responses, I don't see a problem with such servers not shipping with
active key material.  They may not be operationally capable nor deployed
so but would be functionally capable of compliance. The distinction is
that a local security administrator is able to activate DPD signing in
response to emerging threats without recourse to a vendor's software
update.

---

From: Stephen Kent <[email-masked]>
Date: Mon, 12 Apr 2004 20:39:15 -0400

>then this sounds good to me.

Dave,

MUST in this context means that it must be possible for the 
user/admin/owner to configure the server to perform the operation, 
not that the server must always be ready to perform the operation 
irrespective of the locally managed configuration.

Steve

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 12 Apr 2004 19:31:30 -0700

Dave,

Please expand "may not deploy with this feature."

Mike

-----Original Message-----
From: Dave Engberg
Sent: Monday, April 12, 2004 2:31 PM

I assumed that "MUST be capable of" meant that every running
server
instance itself must have the ability to perform signatures.  If
the
correct interpretation for "capable of" is that the software
product has
the capability, but some instances may not deploy with this
feature,
then this sounds good to me.

In short, yes.

---

From: David Engberg <[email-masked]>
Date: Mon, 12 Apr 2004 22:44:59 -0400

A software product includes a module for performing signatures on SCVP 
responses, but an administrator deploys the software with that module 
disabled or removed.  That software product would still be compliant 
because the software is capable of performing signatures even though the 
server instance is not ... (?)

Or is there a subtle difference between configuration vs. code?  I.e. 
would it be ok to turn off signing in an XML file, but not ok to do so 
by installing only half of a complete DPD/DPV suite?

---

From: "Michael Myers" <[email-masked]>
Date: Mon, 12 Apr 2004 21:13:32 -0700

Dave,

Do you mean by "removed" that a local administrator may choose
not to install DPD signing?

Mike

-----Original Message-----
From: David Engberg [mailto:[email-masked]]
Sent: Monday, April 12, 2004 7:45 PM

A software product includes a module for performing signatures
on SCVP
responses, but an administrator deploys the software with that
module
disabled or removed.  That software product would still be
compliant
because the software is capable of performing signatures even
though the
server instance is not ... (?)

Or is there a subtle difference between configuration vs. code?
I.e.
would it be ok to turn off signing in an XML file, but not ok to
do so
by installing only half of a complete DPD/DPV suite?

---

From: David Engberg <[email-masked]>
Date: Tue, 13 Apr 2004 07:16:49 -0400

Yes.  Is that allowable?

CoreStreet's OCSP server software can either be deployed in a 
traditional 1-tier configuration (all online servers have signing keys) 
or a 2-tier configuration (master servers have keys, lightweight 
responders have no keys or any code for signing).

I'm just curious whether your language would permit SCVP software that 
not only allowed those two configurations, but also allowed a third 
configuration where only the lightweight responders (with no keys or 
signing code) were deployed.  The complete software offering is "capable 
of" producing signatures, but the code running on servers in that third 
deployment would not be capable.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 13 Apr 2004 12:54:36 -0400

Dave,

In essentially all IETF standards we focus on what software must be 
capable of doing, so that users and administrators are afforded the 
opportunity to configure a compliant product to enable interoperation 
between peers or clients and servers, or whatever.

I don't see a meaningful difference between the two sorts of 
configuration options you described. Both represent reasonable ways 
to allow the local user/admin to be able to interoperate, as desired.

Steve

---

From: "Michael Myers" <[email-masked]>
Date: Tue, 13 Apr 2004 11:00:41 -0700

Dave,

Installation from original distribution media is perfectly
acceptable to my understanding of "be capable of".

The understanding I wish to achieve is that selectable
functionality (as defined by "be capable of") is produced, fully
tested, and shipped at the same time as mandated
functionality--versus rapidly writing the code, perhaps not
testing it too much if at all, and hustling out a patch in the
context of an emerging threat.

Another way of saying it is that "be capable of" does NOT IMHO
mean "we'll write, ship and be prepared to support the code when
the marketplace asks for it".

I see that Steve has provided us his opinion.  Can close this
thread with a consensus to change the relevant MUSTs to "MUST be
capable of"?.

Mike

-----Original Message-----
From: David Engberg
Sent: Tuesday, April 13, 2004 4:17 AM

Yes.  Is that allowable?

CoreStreet's OCSP server software can either be deployed in a
traditional 1-tier configuration (all online servers have
signing keys)
or a 2-tier configuration (master servers have keys, lightweight
responders have no keys or any code for signing).

I'm just curious whether your language would permit SCVP
software that
not only allowed those two configurations, but also allowed a
third
configuration where only the lightweight responders (with no
keys or
signing code) were deployed.  The complete software offering is
"capable
of" producing signatures, but the code running on servers in
that third
deployment would not be capable.

Michael Myers wrote:
> on SCVP responses, but an administrator deploys the software
> with that module disabled or removed.  That software product
> would still be compliant because the software is capable of
> performing signatures even though the server instance is.