Subject: SCVP : Parsing of Attribute certificates

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:03 +0100

The text states:

   Conforming SCVP Server implementations MUST be able to parse CertReferences 
   that contain either public key or attribute certificates.

[Denis] An SCVP server should be allowed to process PKCs only.

---

From: Tim Polk <[email-masked]>
Date: Fri, 24 Feb 2006 17:51:51 -0500

Denis,

I think we agree in principle.  A few minor edits might help clarify
things.

At 02:41 PM 2/24/2006 +0100, Denis Pinkas wrote:

The text states:

Conforming SCVP Server implementations MUST be able to parse
CertReferences

that contain either public key or attribute
certificates.

[Denis] An SCVP server should be allowed to process PKCs
only.

An SCVP server implementation is required to *parse* a request that
includes attribute certificates, but is not required to include all the
functionality to process them.  That is, an SCVP server that only
supports PKCs shouldn't crash when it gets a request that includes
attribute certificates.

The processing requirements are stated in terms of checks and
wantbacks.  The mandatory to support checks and wantbacks are all
associated with queries about PKCs.  The optional nature of
Attribute certificate query processing is clearly stated in the checks
section, but draft -22 is silent with respect to wantbacks.

In Section 3.2.2 (checks), there are four checks defined for attribute
certificates.  Immediately after the checks are defined, you will
find the following statement:

Conforming SCVP server
implementations MAY support the attribute

certificates checks.

So, a conforming SCVP server that does not process attribute
certificates would return an unsupportedChecks error code (section
4.4).

I did find one error of omission that might should be corrected.  In
Section 3.2.3 (wantbacks), four types of information specific to queries
on attribute certificates may be requested.  There is no conformance
requirement stated for servers, so I propose adding the following
sentence:

Conforming SCVP server
implementations MAY support the attribute

certificate wantbacks.

This would be consistent with the requirements specified elsewhere
in SCVP.

I would be open to a more explicit statement, but I couldn't find an
appropriate place to put it.

Tim Polk