RE: Signing Untrusted SCVP?

[Stephen Kent <[e-mail]>]

At 12:03 AM -0400 4/3/04, Santosh Chokhani wrote:
>Steve:
>
>I do not see a particular reason to require a DPD Server to be held to a
>higher standard then a Directory Server.  We do not require signed responses
>from Directories.  Both being stationary servers, are equally prone to
>hacking.  Also, in order to verify the DPD Server signature, the client may
>get into another problem of obtaining a path for the DPD Server itself, which
>may not be a circular problem, but will degrade performance

We are not the LDAP WG, so we don't make requirements for directory 
access, as I noted in my previous message.  (Our last foray into that 
area is a superceded RFC that had mixed feelings about DoS issues.)

I thought there was a clear need to configure clients with an ability 
to directly verify signatures for DPD and DPV servers. Otherwsie, as 
you note, a circular dependency can arise.

Steve