Subject: proposed revision to SCVP re HTTP

From: Stephen Kent <[email-masked]>
Date: Fri, 31 Aug 2007 13:27:34 -0400

Folks,

As you may recall, SCVP has been stalled because the IESG did not 
feel that the text dealing with HTTP carriage of requests and 
responses was suitable.  The following text has been proposed by the 
cognizant IESG AD, and if PKIX consents, this will become the new 
Appendix B.

I'd like to hear of any objections by the end of next week (September 7).

Thanks,

Steve
-----

Appendix B.  SCVP over HTTP

    This appendix describes the formatting conventions for the SCVP
    request and response when carried by HTTP.

    In order for SCVP clients and servers using HTTP to interoperate,
    the following rules apply.

    - Clients MUST use the POST method to submit their requests.

    - Servers MUST use the 200 response code for successful responses.

    - Clients MAY attempt to send HTTP requests using TLS 1.0 or
    later over port 443, although servers are not required to support
    TLS.

    - Servers MUST NOT assume client support for any type of HTTP
    authentication such as cookies, Basic authentication, or Digest
    authentication.

    - Clients and servers are expected to follow the other rules and
    restrictions in RFC 2616. Note that some of those rules are for
    HTTP methods other than POST; clearly, only the rules that apply to
    POST are relevant for this specification.

B.1  SCVP Request

    An SCVP request using the POST method is constructed as follows:

        The Content-Type header MUST have the value
        "application/scvp-cv-request".

        The body of the message is the binary value of the DER encoding
        of the CVRequest, wrapped in a CMS body as described in Section
        3.

B.2  SCVP Response

    An HTTP-based SCVP response is composed of the appropriate HTTP
    headers, followed by the binary value of the BER encoding of the
    CVResponse, wrapped in a CMS body as described in Section 4.

    The Content-Type header MUST have the value "application/scvp-cv-
    response".

B.3  SCVP Policy Request

    An SCVP request using the POST method is constructed as follows:

        The Content-Type header MUST have the value
        "application/scvp-vp-request".

        The body of the message is the binary value of the BER encoding
        of the ValPolRequest, wrapped in a CMS body as described in
        Section 5.

B.4  SCVP Policy Response

    An HTTP-based SCVP policy response is composed of the appropriate
    HTTP headers, followed by the binary value of the DER encoding of the
    ValPolResponse, wrapped in a CMS body as described in Section 6.

    The Content-Type header MUST have the value "application/scvp-vp-
    response".