Subject: SCVP: 3379 Requirement 32

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:07 +0100

Using a separate request/response pair, the DPV or 
DPD client MUST be able to obtain references for the default policy or for 
all of the policies supported by the server. (6. DPV and DPD Policy Query)

SCVP Draft 22:

An SCVP client uses the Server Policy Request (i.e., the ValPolRequest 
item) "to request information about an SCVP server's policies and 
configuration information, including the list of validation policies 
supported by the SCVP server."
(Section 5)

"In response to a ValPolRequest, the SCVP server provides a ValPolResponse."

The ValPolResponse includes a comprehensive description of the default 
validation policy, as well as a list of all policies supported by the server.
(Section 6)

[Denis] 

ValPolResponse ::= SEQUENCE {
       vpResponseVersion               INTEGER,
       maxCVResponseVersion            INTEGER,
       maxVPResponseVersion            INTEGER,
       serverConfigurationID           INTEGER,
       thisUpdate                      GeneralizedTime,
       nextUpdate                      GeneralizedTime OPTIONAL,
       validationPolicies              SEQUENCE OF OBJECT IDENTIFIER,
       validationAlgs                  SEQUENCE OF OBJECT IDENTIFIER,
       authPolicies                    SEQUENCE OF AuthPolicy,
       responseTypes                   ResponseTypes,
       defaultPolicyValues             RespValidationPolicy,
       revocationInfoTypes             RevocationInfoTypes,
       signatureGeneration             SEQUENCE OF AlgorithmIdentifier,
       signatureVerification           SEQUENCE OF AlgorithmIdentifier,
       hashAlgorithms                  SEQUENCE SIZE (1..MAX) OF
                                          OBJECT IDENTIFIER,
       serverPublicKeys                SEQUENCE OF KeyAgreePublicKey
                                          OPTIONAL,
       clockSkew                       INTEGER DEFAULT 10,
       requestNonce                    OCTET STRING OPTIONAL }

I would expect many of these items to be optional !!!, 
in particular validationAlg, authPolicies, defaultPolicyValues, and then 
signatureGeneration, signatureVerification, hashAlgorithms, serverPublicKeys.

---

From: Tim Polk <[email-masked]>
Date: Fri, 24 Feb 2006 18:30:42 -0500

Denis,

The goal of the ValPolResponse is intended to provide information about
an SCVP server's policies and configuration information, including the
list of validation policies supported by the SCVP server.  Since
servers are required to have a lot of functionality, most of the items in
this sequence are mandatory.

A couple of items (see below) may be encoded as empty sequences, which is
sort of like optional.  We could have avoided the empty sequences by
using explicit tagging and making those items optional.  I for one
am sick of fighting over explicit tags, so we went with empty
sequences.

At 02:41 PM 2/24/2006 +0100, Denis Pinkas wrote:

Using a separate request/response
pair, the DPV or

DPD client MUST be able to obtain references for the default policy or
for

all of the policies supported by the server. (6. DPV and DPD Policy
Query)

SCVP Draft 22:

(Section 5)

"In response to a ValPolRequest, the SCVP server provides a
ValPolResponse."

validation policy, as well as a list of all policies supported by the
server.

(Section 6)

[Denis]

vpResponseVersion
INTEGER,

maxCVResponseVersion
INTEGER,

maxVPResponseVersion
INTEGER,

serverConfigurationID
INTEGER,

thisUpdate
GeneralizedTime,

nextUpdate
GeneralizedTime OPTIONAL,

validationPolicies
SEQUENCE OF OBJECT IDENTIFIER,

validationAlgs
SEQUENCE OF OBJECT IDENTIFIER,

authPolicies
SEQUENCE OF AuthPolicy,

responseTypes
ResponseTypes,

defaultPolicyValues
RespValidationPolicy,

revocationInfoTypes
RevocationInfoTypes,

signatureGeneration
SEQUENCE OF AlgorithmIdentifier,

signatureVerification
SEQUENCE OF AlgorithmIdentifier,

hashAlgorithms
SEQUENCE SIZE (1..MAX) OF

OBJECT IDENTIFIER,

serverPublicKeys
SEQUENCE OF KeyAgreePublicKey

OPTIONAL,

clockSkew
INTEGER DEFAULT 10,

requestNonce
OCTET STRING OPTIONAL }

signatureGeneration, signatureVerification, hashAlgorithms,
serverPublicKeys.

The serverPublicKeys item actually is optional.  The
signatureGeneration and signatureVerification items are required, but may
be encoded as an empty sequence.

[from 6.13]

For servers that do not
have an online private key, and cannot sign

CVResponse messages, the signatureGeneration item is encoded
as an

empty sequence.

[from 6.14]

For servers that do not
verify signatures on CVRequest messages, the

signatureVerification item is encoded as an empty
sequence.

The hashAlgorithms item is required, since every server is
required to be able to hash requests. (see 4.6, requestRef)

Servers are required to support at least one validation algorithm, so the
validationAlg item is required.  The authPolicies item is required
but could be an empty sequence as well.  SCVP requires a default
validation policy which is fully specified in the defaultPolicyValues
item and is not optional.

Tim Polk