RE: DPD & DPV requirements

[Stephen Kent <kent@xxxxxxx>]

Frank,

> Frank Balluffi said:
>
>  > >The client should supply some subset of each requested path
>  > which must
>  > >include the least significant certificate and optionally:
>  > >
>  > >- one or more intermediate certificates
>  > >- one or more trusted certificates
>
> Steve Kent said:
>
>  > An intermediate cert that is not trusted, but is not the end of a
>  > partial path?  Why?  This is getting complicated.
>
> OK. It is difficult for me to imagine a client supplying intermediate
> certificates. But requirement 1.1 only supports a single certificate or a
> chain:
>
> 1.1     A client request can contain a single certificate or a certificate
> chain terminating in the "target" certificate, to assist the server in path
> construction.
>
> Would it be valuable for a client to be able to supply the end-entity
> certificate and the trusted certificate in the path?

What if we say that the chain could be partial?

A trust point (anchor) is a root and the client can specify one or 
more of these as part of the path validation parameter set, 
explicitly or via reference.

Steve