Subject: Re:Lightweight Certificate Validation Protocol (LCVP)

From: "Denis Pinkas" <[email-masked]>
Date: Thu, 3 May 2007 15:41:21 +0200

Peter (Sylvester),

(...)

>I have read the text, and I am waiting to at least a response to one 
>question concerning the service (send some days ago).

Your questions were:

1 -  "LCVP  as well as SCVP allows two different ways to identify a certificate.
Either by providing the certificate or by a reference".

It may be the right time to say that way to provide the certificate in SCVP 
does not allow its support by thin clients.

The certificate is defined by Certificate, which means tha the client must 
fully decode the whole certificate.

The change I mentioned while answering to Stefan, was to define the certificate 
as an OCTET STRING, which has the advantage to only require, for the client, 
the extraction of the public key that is within the certificate.

2 - " In the second case the server needs to access a repository to obtain
a certificate. To which degree does a server trust the repository to
deliver a valid certificate? Or, in other words, would it be equivalent
or not that the client obtains by whatever means a certificate and
provides it as input".

It is equivalent. No trust is needed. However when using electronic signatures 
(or CMS) only the ESSCertId may be present, this explains why the reference is useful.

3 - " If the server is provided with a certificate as input, what is the meaning
of a successful response:

- this is a valid certifcate that has in fact been issued by the CA and 
it is trusted etc

- this certificate seems indeed to be signed by the CA etc".

Firstly, there is no difference in the response whether the request included 
the full certificate or the reference to the certificate.

Secondly, the meaning is none of the two above meanings you mention.
The meaning is: "The certificate is valid according to the validation policy".

Denis

>I also agree with all those who do not want yet another protocol just for
>certficate verification.
>
>As a detail, the definition of the initial verification, revalidation, the
>required inputs for both cases, their security feature, the requirements
>for external access to a repository or not, is very unclear, thus difficult
>to compare with SCVP, XKMS, OCSP, DVCS

---

From: Russ Housley <[email-masked]>
Date: Fri, 04 May 2007 17:50:34 -0400

>the extraction of the public key that is within the certificate.

I have worked with one set of ASN.1 tools that allow the type of 
processing that you describe without having to perform decode/encode 
operations.  Simply provide a pointer to the already encoded 
certificate, and then the certificate is included in the larger 
structure (an SCVP request in this case) without any additional processing.

Russ