RE: DPD & DPV requirements - Recursion Issues

[Stephen Kent <kent@xxxxxxx>]

Peter,

>  > Whatever is contained in a response, it is left untouched.
>  >
>  >      [Carlin's latest response]   OK, but what if there is no 
> provision in the
>  >      DPD response syntax for including an embedded DPD response? 
> The good news
>  >      is that the timestamp on the embedded DPD response is 
> untouched.  The bad
>  >      news is that you can't include an embedded DPD response. 
> Catch vingt-deux.
>
> I am not the best candidate to answer questions about DPD. I am mainly
> interested in DPV (as some might imagine).
>
> Anyway, if I understand Mike Myers remark correctly, if a DPD server
> is essentially untrusted, then it could basically just rewrite a relayed
> response.

Yes, but that will be caught by the client of a DPD server, even a 
DPV server that acts as a DPD client in performing it's function, as 
Steve Hanna suggests.

> A DPD server might have performed an OCSP check or a DPV check (for example
> to validate a CA cert.) The response should be sent back to the DPD
> client, this can be used by the client to make a decision about the
> acceptablity of the path.

An OCSP response if fair game. but I'm not sure I want the DPV 
response to be used recursively, yet.

Steve