Subject: RE: FW: scvp

From: Peter Sylvester <[email-masked]>
Date: Thu, 29 Apr 2004 12:35:43 +0200 (MEST)

> Hi Peter,
> A client could want to optimize the number of SCVP queries. As a SCVP
> client if I just submit a query for the issuing CA rather than the EE,
> its pretty simple to reuse that response across multiple validations.
> Therefore the server can default to a behavior like validate as EE, but
> the client needs to be able to override the default if necessary.
This case seems to me tobe  only one of many others.
but even there, it is unclear to me whether it is orthogonal
to validation algorithms? What is the meaning of valdidation of an 
ssl server, when the client doesn't give the server cert but only the ca cert?
Should the server not test the DNS name? Depending on what criteria?
On the setting of isCA?

What if the client wants to test the ca cert that had issues the ca cert
that had issued the ee cert.  

I suggest a rewriting the isCA paragraph may be in the following model:
 
  A client may want to indicate further details concerning the
  starting certifictae in a path (? for DPV, DPD?)
  - (1) whether the paths does not contain all parts,
  - (2) whether ... 

  in order to indicate (1), the clients set the value of isCA to XXX.
  in order to indicate (2), the client ...

or, it seems to me that currently you want:

A client has the possibility to indicate that the cert
to be validated is not the stating point in the path but the CA
cert that has signed it. in order to do so, the client set the
isCA boolean.