Subject: SCVP : 3379 Requirement 2 - validationPolicy

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:05 +0100

If the DPV request does not specify a validation 
policy, the server response MUST indicate the validation policy that was 
used. (4.1. Basic Protocol)

SCVP Draft 22:

All DPV requests include the validationPolicy item. The validationPolicy 
item is itself a sequence with a single mandatory item, the 
validationPolRef item. (section 3.2.4)

[Denis]
1 - The fact that there is a single mandatory item is in contradiction with the requirement.

The SCVP client either specifies a particular validation policy or the 
server's default policy as an object identifier in the validationPolRef 
item. (section 3.2.4.1) The parameters associated with this policy may be 
modified through the use of optional items in the validationPolicy. 
(sections 3.2.4.1 through 3.2.4.9)

[Denis]
2 – The so-called “server's default policy” does not allow to know which validation policy 
was used. The “server's default policy” has a meaning that is server dependant. 
A given server may also decide to change upon time its default validation policy and 
thus the single OID does not allow to know which policy was used. The concept of 
“server's default policy” with a fixed OID does not work. The usual concept of 
“server's default policy” is fairly different: when the validation policy 
is NOT indicated in the request, THEN the server returns the OID of the validation policy 
that was used. This OID must be fully unambiguous.

In addition, the “server's default policy” may be different for DPV and for DPD.

See my proposal for the redefinition of ValidationPolicy.

---

From: Tim Polk <[email-masked]>
Date: Mon, 27 Feb 2006 16:06:52 -0500

Denis,

To my reading, RFC 3379 does not require that the validation policy be 
optional.  It is certainly true that the requirements of this aspect of the 
SCVP protocol are more stringent than 3379, but they are not in conflict.

SCVP has for many drafts, and perhaps since inception, mandated that the 
policy be specified in the request and response.  I believe this has WG 
support, and there is no reason to change it.

I also respectfully disagree with your characterization of the default 
validation policy.  The details of this policy are always available to the 
client through the validation policy response.  The client can confirm that 
the default validation policy has not changed through the server 
configuration ID.  It is unanambiguous to the party that matters - the client!

Finally, I am unsure why you believe the default validation policy can be 
different for DPV and DPD.  I do not believe that is correct.  The 
validation policy describes the server's actions in building a path, but 
not the client's actions.  DPD and DPV requests are differentiated by the 
checks and wantbacks, not the validation policy.

Thanks,

Tim

At 02:41 PM 2/24/2006 +0100, Denis Pinkas wrote:

>2  The so-called “server's default policy” does not allow to know which 
>validation policy