Subject: SCVP: 3379 Requirement 17

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:06 +0100

The DPV server MAY require client authentication, 
therefore, the DPV request MUST be able to be authenticated. 
(4.1 Basic Protocol)

SCVP Draft 22:

"There are two forms of SCVP request: unprotected and protected. A 
protected request is used to authenticate the client to the server or to 
provide anonymous client integrity over the request-response pair. The 
protection is provided by a digital signature or message authentication 
code (MAC). In the later case, the MAC key is derived using a key 
agreement algorithm, such as Diffie-Hellman. If the client's public key is 
contained in a certificate, then it may be used to authenticate the 
client. More commonly, the client's key agreement public key will be 
ephemeral, supporting anonymous client integrity.

[Denis]

“ anonymous client integrity” is not a requirement. 
Supporting Diffie-Hellman is not a requirement either. 
The draft is using too many authentication methods (MAC !) and 
should restrict the use to digital signatures, otherwise 
interoperability will never be achieved.

---

From: Tim Polk <[email-masked]>
Date: Fri, 24 Feb 2006 18:07:14 -0500

Denis,

Interoperability should be achieved through the mandatory to implement
features.  Defining additional features does not violate the spirit
of the requirements document, IMHO.  I also believe that defining
additional optional features is in line with general IETF
philosophy.

From section 3:

"All SCVP
clients MUST support SignedData for signed requests and

responses."

From section 4:

"For protected
requests and responses, SCVP servers MUST support

SignedData and SHOULD support AuthenticatedData.  It is
a matter of

local policy which types are used.

If the server is making a protected response to a protected
request,

then the server MUST use the same protection mechanism
(SignedData

or AuthenticatedData) as in the request.

I believe this is sufficient to achieve interoperability, while
providing sufficient flexibility to support local policy
decisions.

Tim

At 02:41 PM 2/24/2006 +0100, Denis Pinkas wrote:

The DPV server MAY require client
authentication,

(4.1 Basic Protocol)

SCVP Draft 22:

agreement algorithm, such as Diffie-Hellman. If the client's public key
is

[Denis]