Subject: SCVP: 3379 Requirement 3

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:05 +0100

The protocol MUST allow the client to include these 
policy dependent parameters in the DPV request; however, it is expected 
that most clients will simply reference a validation policy for a given 
application or accept the DPV server's default validation policy. (4.1. 
Basic Protocol)

SCVP Draft 22:

All DPV requests include the validationPolicy item. The validationPolicy 
item is itself a sequence with a single mandatory item, the 
validationPolRef item. (section 3.2.4)

The SCVP client either specifies a particular validation policy or the 
server's default policy as an object identifier in the validationPolRef 
item. (section 3.2.4.1) The parameters associated with this policy may be 
modified through the use of optional items in the validationPolicy. 
(sections 3.2.4.1 through 3.2.4.9)

[Denis]

The text says that the parameters associated with server's default policy 
may be *modified* through the use of optional items in the validationPolicy.

It means that these items cannot be used with other validation policies.
However, these parameters would be useful, not to MODIFY the parameters 
associated with a given policy, but to DEFINE some parameters of a 
given validation policy, which does NOT specify it.

See my proposal for the redefinition of ValidationPolicy.

---

From: Tim Polk <[email-masked]>
Date: Mon, 27 Feb 2006 16:41:52 -0500

Denis,

I have reviewed the remainder of your comments on draft -22.  Since each 
references your proposed redefinition of validation policy, I am answering 
them in one message.

IMHO, the current definition of validation policy satisfies all 
requirements specified in 3379.  Your comments on requirements 3 and 25 
reference the validation policy, but I do not see any violation of the 
requirement as stated in 3379:

	Requirement #3  The protocol MUST allow the client to include these policy 
dependent parameters in the DPV request; however, it is expected that most 
clients will simply reference a validation policy for a given application 
or accept the DPV server's default validation policy. (4.1. Basic Protocol)

SCVP certainly satisfies this requirement.  Whether the parameters provided 
by the client "modify" or "define" components of the validation policy is 
irrelevant.

	Requirement #25: The DPD request MUST allow more elaborated path discovery 
policies to be referenced. (5. Delegated Path Discovery Protocol)

The SCVP client may specify every parameter of the validation policy if it 
so chooses.  This clearly satisfies the requirement.

The remaining comments that reference the validation policy structure are 
outside the scope of 3379 ("parameters from the Basic Validation Algorithm" 
and "Basic & Name Validation Algorithms").  Your proposal represents one 
reasonable way to encode the validation policy, and the current text of 
SCVP represents another reasonable alternative.  We all know which you 
prefer, but I also feel that the WG has consistently demonstrated rough 
consensus supporting the current structure.

We have hashed and rehashed this topic.  Given that the 3379 requirements 
are not violated and the WG has shown rough consensus supporting the 
current structure, we have no basis for making these changes.

We should respect WG consensus, retain the current structure for validation 
policy, and move on to other topics.

Tim Polk