Subject: SCVP: 3379 Requirement 8 (minor)

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:05 +0100

The DPV server MUST have the certificate to be 
validated. When the certificate is not provided in the request, the server 
MUST obtain the certificate and then verify that the certificate is indeed 
the one being unambiguous referenced by the client. (4.1 Basic Protocol)

SCVP Draft 22:

The DPV client must either explicitly provide the certificate to be 
validated to the DPV server or reference the certificate by its hash value 
in the queriedCerts item.

(Section 3.2.1)

The DPV server returns this information in the replyStatus item, which 
gives status information to the client about the request for the specific 
certificate.

If the certificate is not included in the request (i.e., the certificate is 
referenced by hash value), and the server is unable to obtain the 
certificate, the replyStatus will be 4:

[Denis] The text copied above is incorrect, but is NOT in SCVP Draft 22 !!!

---

From: Tim Polk <[email-masked]>
Date: Fri, 24 Feb 2006 17:57:15 -0500

Denis,

The text I included in the matrix was a summary of how draft -22 meets this 
requirement.  It was not a quote from the text.  I do believe it is an 
accurate description of the document, and that -22 satisfies the requirement.

Tim