Subject: RE: SCVP 16 comments deadline

From: Peter Sylvester <[email-masked]>
Date: Thu, 9 Dec 2004 14:12:38 +0100 (MET)

second reply: 

by changing policy to algorithm in 3.1.5.1 my question may be answered;

  When using the default validation policy, the client can override 
  any of the default parameter values by supplying a specific value 
  in the request.  The SCVP server MUST make use of the provided 
  parameter values or return an error response. 

* 
* b) Section 3.1.5.1 is titled "Default Validation Algorithm" but
* discusses the default validation policy.

[TF] This should have read algorithm not policy and is now fixed.

What is the link to :

  Neither the clients nor server MUST dereference the URI during SCVP 
  request processing.  The URI is simply used as a reference for the 
  validation policy.  Clients and server MAY dereference the URI as 
  part of configuration. 
   
  The syntax of the validationPolRef is: 
   
    ValidationPolRef ::= CHOICE { 
      valPolRefByOID     [0] OBJECT IDENTIFIER, 
      valPolRefByURI     [1] IA5String } 
   
  If there are any conflicts between the non-default policy 
  referenced in the request and any supplied parameter values in the 
  request, then the server MUST return an error response. 

In what places policy has to be changed to algorithm in 3.1.5.1? 

> 
> Hi Peter,
> All parameter assonated with policy mapping are names the same. If you
> want guidance on their use in combination with the policy reference see
> section 1.3.
> SCVP only supports one policy per request therefore if you want to
> process different polices for different certificates - send different
> requests.
> Trevor
> 
> * -----Original Message-----
> * From: Peter Sylvester [mailto:[email-masked]]
> * Sent: Tuesday, December 07, 2004 4:15 AM
> * To: Trevor Freeman
> * Cc: [email-masked]
> * Subject: Re: SCVP 16 comments deadline
> * 
> * There are several boolean values like
> * 
> *   ValidationPolicy ::= SEQUENCE {
> *     ...
> *     inhibitPolicyMapping  [2] BOOLEAN OPTIONAL,
> * 
> * and a policy definition.
> * 
> *   ValidationPolValues ::=SEQUENCE  {
> *     ...
> *     inhibitPolMap            BOOLEAN,
> * 
> * 
> * - It would be nice to use the same field names.
> * 
> * - I suggest BOOLEAN DEFAULT FALSE for the inhibitPolMap together
> *   with some apppropriate tagging, it doesn't make much sense to
> *   me to code useless values.
> * 
> * Would it be possible to add some statement about the intended
> * meaning of the 6 possible combination:
> * 
> * 
> * inhibitPolMap = FALSE
> * 
> * inhibitPolicyMapping absent  1
> *                      FALSE   2
> *                      TRUE    3
> * 
> * inhibitPolMap = TRUE
> * 
> * inhibitPolicyMapping absent  4
> *                      FALSE   5
> *                      TRUE    6
> * 
> * 
> * Does it mean that when the client value takes preceedence over the
> * server value?
> * 
> * 1 = FALSE
> * 2 = FALSE
> * 3 = TRUE
> * 4 = TRUE
> * 5 = FALSE
> * 6 = TRUE
> * 
> * 
> * It had been said some time ago (as far as I remember) that these
> * inputs are not global ones but in principle for each of the
> * certs to be asked for. what was the conclusion why they stay global
> * for all certs?
> 
> 
>

---

From: Denis Pinkas <[email-masked]>
Date: Thu, 09 Dec 2004 15:53:08 +0100

Trevor,

> [TF] This should have read algorithm not policy and is now fixed.

I do not agree with that fix.
You will see it when reading my comments 17 and 18.

Denis