Subject: SCVP: 3379 Requirement 34

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:07 +0100

The validation policy MUST specify the source of 
revocation information:

1. full CRLs (or full Authority Revocation Lists) have to be collected.
2. OCSP responses, using [OCSP], have to be collected.
3. delta CRLs and the relevant associated full CRLs (or full Authority 
   Revocation Lists) are to be collected.
4. any available revocation information has to be collected.
5. no revocation information need be collected.

(Source for 34: 7.3. Revocation Requirements)

SCVP Draft 22:

The valPolResponse includes the revocationInfoTypes item.

RevocationInfoTypes ::= BIT STRING {
fullCRLs (0),
deltaCRLs (1),
indirectCRLs (2),
oCSPResponses (3) }

[Denis] The following cases are not supported:

4. any available
5. no revocation

In addition, indirectCRLs (2) is NOT a requirement 
and should be deleted.

---

From: Tim Polk <[email-masked]>
Date: Mon, 27 Feb 2006 13:27:02 -0500

Denis,

While section 6.11 does not state it directly, I believe both cases are 
supported by the current syntax:
(1) if all elements in the the bit string RevocationInfoTypes are set to 
zero, then the server is indicating that it does not use any revocation 
sources; and
(2) if all elements in the bit string RevocationInfoTypes are set to one, 
then the server is indicating that it uses all available revocation 
sources.  (These are all the sources that can be conveyed in SCVP, so they 
are all available sources!)

If you feel the clarification is necessary, I would be glad to add these 
two statements to 6.11.

I do not believe that the indirectCRLs bit should be deleted.  While 
indirect CRLs were not called out in RFC 3379, I do not see any problem 
*expanding* the list in SCVP.  In fact, I believe it is required to fully 
specify the sources of revocation information used under a particular 
validation policy.  The delta CRL and full CRL bits are insufficient to 
indicate whether indirect CRLs are processed under a given validation policy.

Tim