Subject: Re: SCVP editors' draft

From: Peter Sylvester <[email-masked]>
Date: Thu, 20 Oct 2005 19:46:55 +0200

> A point related to a topic that interests Peter. In section 3.3 the 
> text states:
>
> “Conforming SCVP server implementations MUST process the requestorRef
>
> value if present”.
>
> This is incorrect, since it is only a requirement if the SCVP server 
> is performing relaying.
>
Good question, here is one thought.

It could occur that a server was erroneously presented with a reference
that carries its own id. If this came from another server that relayed 
to it,
the final response may have two authentication envelopes with identical
identifiers. Or, the responder field of this response would be the same
as the one that will further down encapsulate it.

C -> A(1) -> B -> A(2)

B receives response from A2, ancapsulates or relays it to A1, and A1
includes this in its respones to C.

If I have to keep this structure for some long term, I might have
problems to explain the difference between A1 and A2.

I don't know whether this really presents a problem.

maybe someone on the pkix list has an opinion, I'll CC it.

-- 
To verify the signature, see http://edelpki.edelweb.fr/ 
Cela vous permet de charger le certificat de l'autorité; 
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

---

From: "David A. Cooper" <[email-masked]>
Date: Fri, 21 Oct 2005 10:48:46 -0400

For an SCVP server that does not perform relaying, the server MUST 
process the requestorRef value if it is present in the request, but the 
processing requirements are very simple.  From section 4.7:

    If the SCVP client includes a requestorRef value in the request, 
then the SCVP server
    MUST return the same value if the server is generating a non-cached 
response.

Section 7 imposes further requirements for the processing of the 
requestorRef item but, as the first paragraph of section 7 explicitly 
states, these further processing requirements only apply to servers that 
implement relay.

Dave