Subject: RE: SCVP: Proposed redefinition of validation policy

From: "Seth Hitchings" <[email-masked]>
Date: Tue, 28 Feb 2006 16:45:33 -0500

Tim,

Although I feel that the syntax of the ValidationPolicy and ValidationAlg
are somewhat  confusing, I agree with you that the existing definitions
satisfy the requirements and are perfectly usable. I'm satisfied with the
existing definition of ValidationPolicy and with draft 22 in general.

Seth Hitchings

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tim Polk
Sent: Monday, February 27, 2006 4:42 PM
To: Denis Pinkas; pkix
Subject: SCVP: Proposed redefinition of validation policy

Denis,

I have reviewed the remainder of your comments on draft -22.  Since each
references your proposed redefinition of validation policy, I am answering
them in one message.

IMHO, the current definition of validation policy satisfies all requirements
specified in 3379.  Your comments on requirements 3 and 25 reference the
validation policy, but I do not see any violation of the requirement as
stated in 3379:

	Requirement #3  The protocol MUST allow the client to include these
policy dependent parameters in the DPV request; however, it is expected that
most clients will simply reference a validation policy for a given
application or accept the DPV server's default validation policy. (4.1.
Basic Protocol)

SCVP certainly satisfies this requirement.  Whether the parameters provided
by the client "modify" or "define" components of the validation policy is
irrelevant.

	Requirement #25: The DPD request MUST allow more elaborated path
discovery policies to be referenced. (5. Delegated Path Discovery Protocol)

The SCVP client may specify every parameter of the validation policy if it
so chooses.  This clearly satisfies the requirement.

The remaining comments that reference the validation policy structure are
outside the scope of 3379 ("parameters from the Basic Validation Algorithm" 
and "Basic & Name Validation Algorithms").  Your proposal represents one
reasonable way to encode the validation policy, and the current text of SCVP
represents another reasonable alternative.  We all know which you prefer,
but I also feel that the WG has consistently demonstrated rough consensus
supporting the current structure.

We have hashed and rehashed this topic.  Given that the 3379 requirements
are not violated and the WG has shown rough consensus supporting the current
structure, we have no basis for making these changes.

We should respect WG consensus, retain the current structure for validation
policy, and move on to other topics.

Tim Polk