Subject: Re: FW: scvp

From: Peter Sylvester <[email-masked]>
Date: Mon, 26 Apr 2004 13:27:31 +0200 (MEST)

what is the meaninng of 

  endEntityCertificationPolicy  vs caCertificationPolicies

(without nitpicking that both are SEQUENCE). 

>     ParamsDefValPolicy :: = SEQUENCE {
>         trustAnchors                  TrustAnchors,
>         endEntityCertificationPolicy  SEQUENCE OF OBJECT IDENTIFIER OPTIONAL,
>         inhibitPolMap                 BOOLEAN DEFAULT FALSE,
>         caCertificationPolicies       SEQUENCE OF OBJECT IDENTIFIER OPTIONAL }
> 

I may be able to understand that in order to to 3280 path validation, one
has to provide the seven input parameters in some way. Aren't some flags indicating 
  
   require Explicit Policy
   ignore Any Policy

missing?

---

From: Denis Pinkas <[email-masked]>
Date: Mon, 26 Apr 2004 13:48:02 +0200

Peter,

>   endEntityCertificationPolicy  vs caCertificationPolicies

Your question makes sense. The default validation algorithm is too simple 
and does not make any difference bewteen the CP appropriate for the 
end-entity certificate (i.e. endEntityCertificationPolicy) and the CP 
appropriate for the CA certificates (i.e. caCertificationPolicies).

So these two parameters make one only for the default validation policy. It 
however obvious that more elaborate validation policies would be able to 
make the difference.

This raises me an observation. The parameters for a given CP should be 
depended upon the OID of the validation policy.

This means that a better (and much simpler) structure would be:

Query ::= SEQUENCE {
         queriedCerts            SEQUENCE SIZE (1..MAX) OF CertReference,
         checks                  CertChecks,
         wantBack                WantBack,
         requestRefHash          BOOLEAN DEFAULT TRUE,
         serverContextInfo       OCTET STRING OPTIONAL,
         validityTime            GeneralizedTime OPTIONAL,
         includePolResponse      BOOLEAN DEFAULT FALSE,
         valPolicy               ValidationPolicy,
         intermediateCerts   [0] CertBundle OPTIONAL,
         revInfos            [1] RevocationInfos OPTIONAL,
         queryExtensions     [2] Extensions OPTIONAL }

with:

    ValidationPolicy  ::=  SEQUENCE  {
         algorithm               OBJECT IDENTIFIER,
         parameters              ANY DEFINED BY algorithm OPTIONAL  }

Then the parameters of the default validation policy should be defined.

Thanks for the observation.

Denis