Subject: SCVP: default validation policy

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:01 +0100

The text states:

   The default validation policy corresponds to standard certification path processing 
   as defined in [RFC 3280] with server chosen default values (e.g., with a server
   determined policy set and trust anchors).

[Denis] When the default validation policy is being used, then 
a third party cannot know which validation policy was used since the OID 
of the so-called “default validation policy" has a meaning which is different 
from server to server and for the same server, may change upon time. 

See my proposal for the redefinition of the ValidationPolicy.

---

From: Tim Polk <[email-masked]>
Date: Fri, 24 Feb 2006 16:59:03 -0500

Denis,

Thanks for getting your comments in!  I will respond to each as quickly as 
possible.

At 02:41 PM 2/24/2006 +0100, Denis Pinkas wrote:

>of the so-called "default validation policy" has a meaning which is different

[Tim]   In truth, it doesn't matter if the response includes the default 
validation policy or a "unique" policy OID.  An independent third party is 
only slightly better off with the "unique" policy OID, since they have to 
find an authoritative description of its meaning.  (Anyone who has tried to 
chase down a strange certificate policy OID can tell you how hard it is to do!)

An independent third party only knows how to interpret a response if there 
is an explicit statement of the details of the validation policy used to 
create the response.

Fortunately, SCVP draft -22 includes two ways to achieve this important 
functionality:

#1  If an SCVP client intends to retain the SCVP response for presentation 
to a third party, the client can set responseValidationPolByRef to FALSE in 
the responseFlags in the request.  (section 3.2.5)  The SCVP server is 
required to populate the respValidationPolicy item in the corresponding 
response with the full policy by value that was used by the server to 
validate the request.  (section 4.5)

An independent third party can easily interpret the response, since the 
details of the validation policy are explicitly stated in the response itself.

#2  If an SCVP client routinely retains SCVP responses from a particular 
server under its default policy, it may be more efficient to archive the 
server's valPolResponse message (which explicitly defines the default 
policy) and request SCVP responses where the validation policy is 
identified by reference.  When the policy is identified by reference, the 
SCVP server is required to explicitly state any parameters that were 
overridden (i.e.,  at the client's request), so the SCVP response and the 
valPolResponseMessage provide the independent third party with all the 
information required to interpret the response.  The independent third 
party uses the serverConfigurationID, which appears in both messages, to 
ensure that the meaning of the policy is still the same.

Personally, I prefer #1.  Disk space is really cheap these days.  :)

>See my proposal for the redefinition of the ValidationPolicy.

I believe the proposed redefinition is orthogonal to the problem identified 
here.

Tim Polk