Subject: Re: SCVP remarks.

From: Peter Sylvester <[email-masked]>
Date: Wed, 11 Aug 2004 13:33:50 +0200 (MEST)

Sorry for the bad subject in the previous mail.

> * 3) In May 204 trevor wrote:
> * 
> * > I think we can use the Cert sign bit in key usage so the is CA bit
> can
> * > be removed from SCVP15
> * 
> * which was not done.
> 
> 
> [TF] Yes I reconsidered that position. Since the 3280 path validation
> algorithm uses the basic constrains extension as it's test for CA
> certificates (3280, 6.1.4, k) and that algorithm is a mandatory feature
> for every SCVP validation algorithm, I concluded it was safer to use the
> same test rather than risk another based on key usage.
> 

The boolean isCA does not indicate at all how the server determines
whether a cert is a CA cert. You may consider to at least reference 
what the server is supposed to perform as a test.  

Since you returned to you original definition, please respond to
my repeated suggestion to use an integer representing a minimal value
for pathmenth in the basicconstraints instead of a boolean.   

> * 
> * 4) Somewhat related to this, and to the provisions to search in DPD or
> * validate
> *    in DPV several types of extensions, I had proposed to opetionally
> * search
> *    for the pathlength basicconstraint. if for example a client has a
> *    cert and a CA cert then one could use it to search only for CAs
> that
> *    have at least a pathlength of 1.
> * 
>