Subject: SCVP trust anchors.

From: Peter Sylvester <[email-masked]>
Date: Wed, 25 Aug 2004 12:38:27 +0200 (MEST)

The current text concerning trust anchors is: 

..

3.2.14 trustAnchors 
   
  The OPTIONAL trustAnchors item specifies the trust anchors to be 
  used by the SCVP server.  One or more certificate policy MAY be 
  associated with each trust anchor.  If a trustAnchors item is 
  present, the server MUST NOT use any certification path trust 
  anchors other than those provided. 

..

6.5 trustAnchors 
   
  The trustAnchors item specifies the default trust anchors that the 
  SCVP server will use if the client directly or indirectly omits the 
  trustAnchours from the request.   

I am not sure whether this text is clear enough to allow the 
following:

1 - the server has a list of trust anchors, and the client may select
    a subset. (an enterprise server)

2 - The server has a potentially empty default list of trust anchors, 
    and the client can (must if empty) select another one.

In fact, I'd rather split the second one into two different policies,
or in other words, when the default server list is empty, the client's
list is taken as is, otherwise only the elemnts in both client and
server list are taken.