Subject: SCVP : parameters from the Basic Validation Algorithm

From: "Denis Pinkas" <[email-masked]>
Date: Fri, 24 Feb 2006 14:41:01 +0100

The text states :

   When id-svp-basicValAlg appears in valAlgId, the parameters item
   MUST be absent.

In fact the parameters from the Basic Validation Algorithm are misplaced 
since they are placed in ValidationPolicy.

These misplaced parameters are :

       userPolicySet         [1] SEQUENCE SIZE (1..MAX) OF OBJECT
                                   IDENTIFIER OPTIONAL,
       inhibitPolicyMapping  [2] BOOLEAN OPTIONAL,
       requireExplicitPolicy [3] BOOLEAN OPTIONAL,
       inhibitAnyPolicy      [4] BOOLEAN OPTIONAL,
       trustAnchors          [5] TrustAnchors OPTIONAL,
       keyUsages             [6] SEQUENCE of OF KeyUsage OPTIONAL,
       extendedKeyUsages     [7] SEQUENCE OF KeyPurposeId OPTIONAL

Hereafter is a proposal for re-defining ValidationPolicy

ValidationPolicy ::= SEQUENCE {
       validationPolRef          ValidationPolRef,
       usefulPolicyParameters    UsefulPolicyParameters OPTIONAL }

UsefulPolicyParameters :: = SEQUENCE {
     certPolicySet            [1] SEQUENCE SIZE (1..MAX) OF OBJECT
                                  IDENTIFIER OPTIONAL,
     inhibitPolicyMapping     [2] BOOLEAN OPTIONAL,
     requireExplicitPolicy    [3] BOOLEAN OPTIONAL,
     inhibitAnyPolicy         [4] BOOLEAN OPTIONAL,
     trustAnchors             [5] TrustAnchors OPTIONAL,
     keyUsages                [6] SEQUENCE of OF KeyUsage OPTIONAL,
     extendedKeyUsages        [7] SEQUENCE OF KeyPurposeId OPTIONAL,
     nameValidationAlgParms   [8] NameValidationAlgParams OPTIONAL }

For lightweight implementation this is far less frightening and this allows to get rid of 
ValidationAlg which was somewhat duplicating the meaning of validationPolRef.

Now, if a very clever client wants to define the parameters of the basic validation algorithm 
defined in 3280, even enriched with name comparison constraints, it could use an OID 
that would NOT be called “ server's default validation policy”, but “basic validation policy”. 
In such a case the client would need to define all the parameters that it wishes to use. 
For that policy there would be NO server defined parameters.