From nobody Thu May 25 00:52:18 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D989E1242F5 for ; Thu, 25 May 2017 00:52:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f-uhhHBBcVNj for ; Thu, 25 May 2017 00:52:04 -0700 (PDT) Received: from mail-wm0-x236.google.com (mail-wm0-x236.google.com [IPv6:2a00:1450:400c:c09::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D056B129C6F for ; Thu, 25 May 2017 00:52:03 -0700 (PDT) Received: by mail-wm0-x236.google.com with SMTP id d127so87931989wmf.0 for ; Thu, 25 May 2017 00:52:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=to:from:subject:message-id:date:user-agent:mime-version :content-transfer-encoding; bh=ma/aM18BGHhg7Z22WK7Oapx+rp+VbHn9+YxPPpTZAMk=; b=ny8OXep6qoosn2F9/o+PwW+elJO3y+jzuO3Wc5jr/+yGgrB/eQkhKsDaGzgztfuzYO nVwEeLed4PBO5y0V/43WBCB3slTTaLD5S26ml5hFf+aNcslev8aXUfc/LlKpC5qlQrXK firZc4C5Qb7MRRZBaNxRmWqFhJMdC3ueuBenIxZroizs6WQuB6z60u8RSKlGntviawmy zUNQWTt7iiylB69E7tL6Fw9aFHakbA/rqyHO8FC/JJAOpd/8el1g5dETuByCYZ9kXHCo n7hK8Nb8CaWwwmS1dnU/0GaPemkop1QikIQK7J1qLdwpLfH6/X3qtuhZZJKPIMaiqwyX v14w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:from:subject:message-id:date:user-agent :mime-version:content-transfer-encoding; bh=ma/aM18BGHhg7Z22WK7Oapx+rp+VbHn9+YxPPpTZAMk=; b=tKIJpW0jNjlD1CXZ5ReTIzGxqXUjFJ9WSFCNFC2/L5K6khjvE1hhEMyxbOjNZJ5sdT dbctJ8VX0y4hNQYssA+Jo6BUze+gnqsOwz0Ix3gK4TYGE+wg/hdxhwU1lWNy7jKS+Z80 9euHuC0RD81VmfSE0mITrNkVYyrmTxICTBytcae9Z2Xdn0szSC5ea+pPXzf6cTNoT+qF bWwe5KhjwkQcWRXsUpCr/L3nmKC2tkKoNw9Snn7tYuwQvjZSshx2EbuUfY6TIpsiCIS0 ASJYhOl1OtP9WBWN5uFHE6b8dmeiglmvDoX/smX6xDlWs6A5JO8zaATc2LwQPYHFMNs/ z91g== X-Gm-Message-State: AODbwcAfqX6508/neBeVmS/FCCztW64lv0jjd9hS02eaEG5vOVkDFQfm R2h1i0BaRVv/h/qz X-Received: by 10.28.16.72 with SMTP id 69mr8674370wmq.30.1495698722104; Thu, 25 May 2017 00:52:02 -0700 (PDT) Received: from [192.168.1.79] (124.25.176.95.rev.sfr.net. [95.176.25.124]) by smtp.googlemail.com with ESMTPSA id y3sm5151417wrd.23.2017.05.25.00.52.00 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 25 May 2017 00:52:01 -0700 (PDT) To: "pkix@ietf.org" From: Anders Rundgren Message-ID: <84a84dc2-432c-b5c2-6d94-58c2ff1f00f7@gmail.com> Date: Thu, 25 May 2017 09:51:59 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [pkix] CMP/EST versus FIDO Alliance X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 May 2017 07:52:07 -0000 In FIDO alliance products key container attestations is a mandatory feature, while in PKIX related enrollment standards it is still a largely unknown concept: https://www.ietf.org/mail-archive/web/pkix/current/msg33122.html Anders From nobody Thu May 25 20:24:35 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA13812009C for ; Thu, 25 May 2017 20:24:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.8 X-Spam-Level: X-Spam-Status: No, score=-0.8 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iqa00YhE_P_x for ; Thu, 25 May 2017 20:24:31 -0700 (PDT) Received: from mail-wm0-x230.google.com (mail-wm0-x230.google.com [IPv6:2a00:1450:400c:c09::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10543126579 for ; Thu, 25 May 2017 20:24:31 -0700 (PDT) Received: by mail-wm0-x230.google.com with SMTP id 7so113159095wmo.1 for ; Thu, 25 May 2017 20:24:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=r2AIDm/wmmR6pjNnUEhHhmZZ25+mf3oyymqywlSjkXo=; b=OOmeDRTmZGxOzUKQbCls83YFE/8UPk0n6Itxki05Q2E0v5AErN5CKc6zlD41efJ8mK LBR7a8q1+ZxH+2YXdvfyPRs+8HM3EeHlJOPxaObla1LKihisGVzdbQflfZNGF+h/Zm0R s4fvAg1i/gAphea+VrALWAAZYfAOkRtysYwzcN6805nTwHZOIDFwR341/kq1ZXcfo+sU ty7uA1cfhIIkxFplVqSaf1m7XWRSRbUcZ5lkIXt78GdbwxKefWWFYF+qSMbw4ywzt30V DhI2f4rmxkO2kJV6H/P7YsW8SdxHDcnKYrv+dxut64P1Ne+b+f7GwnQcGdicwPFis0fr eAhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=r2AIDm/wmmR6pjNnUEhHhmZZ25+mf3oyymqywlSjkXo=; b=NnjPg7JUkDWHyk6guaqHaJ0lbhUh0z7IfftlH7e1+n9uSxDcHq6B+lXZe3boD1QlfM H+oHMqv4tl/IGNhT4f0FhSMLJezFHSD4gyi9ViZJNjXxNQMgrtpp3FgUHzrHzXdwn+SZ 0aJO1L2m9+w+sMYtcAG8I8vSYNOfWc5d8lXr0oNdMZELHOSdBjguRhqz1ThJChshooMB s0LDHk6FF92VTTg0iumkSLN50/WRtJhBQwJVpsDQYOxUG5/w0iYrXlTrB6RDFFC5C7Cl 0msFQBWLLb1GxB7Ukb0Pgbzzn0CFT5P1xKi16b3JTNSSKXrcZCaGWfWVyWFMSyoriFSF gijg== X-Gm-Message-State: AODbwcCdTYeHyGZw6ZBnyACDVCAGHxlzVCEGnIuyBRCabP15F5Llyrql Q4oMARD9vH1ORZ8t X-Received: by 10.28.66.23 with SMTP id p23mr406527wma.38.1495769069392; Thu, 25 May 2017 20:24:29 -0700 (PDT) Received: from [192.168.1.79] (124.25.176.95.rev.sfr.net. [95.176.25.124]) by smtp.googlemail.com with ESMTPSA id v7sm13086126wrb.68.2017.05.25.20.24.27 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 25 May 2017 20:24:28 -0700 (PDT) To: "pkix@ietf.org" References: <84a84dc2-432c-b5c2-6d94-58c2ff1f00f7@gmail.com> From: Anders Rundgren Message-ID: <2e4c2261-d4c1-c6e0-f78a-71859925294a@gmail.com> Date: Fri, 26 May 2017 05:24:26 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: <84a84dc2-432c-b5c2-6d94-58c2ff1f00f7@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [pkix] CMP/EST versus FIDO Alliance X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 May 2017 03:24:33 -0000 On 2017-05-25 09:51, Anders Rundgren wrote: > In FIDO alliance products key container attestations is a mandatory feature, while in PKIX related enrollment standards it is still a largely unknown concept: > > https://www.ietf.org/mail-archive/web/pkix/current/msg33122.html > > Anders I forgot to mention that deployment of a "second factor" is also a mandatory part of FIDO alliance products, while entirely absent in PKIX counterparts: https://www.ietf.org/mail-archive/web/pkix/current/msg28990.html Now the browser vendors have removed support for enrollment of client-side PKI which is quite logical given the inferior state of this technology. Anders From nobody Sat May 27 23:06:34 2017 Return-Path: X-Original-To: pkix@ietfa.amsl.com Delivered-To: pkix@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F872126BF3 for ; Sat, 27 May 2017 23:06:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TJp6edB-JCv5 for ; Sat, 27 May 2017 23:06:31 -0700 (PDT) Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com [IPv6:2a00:1450:400c:c09::243]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 547BD1200F1 for ; Sat, 27 May 2017 23:06:31 -0700 (PDT) Received: by mail-wm0-x243.google.com with SMTP id g15so10237819wmc.2 for ; Sat, 27 May 2017 23:06:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:subject:to:message-id:date:user-agent:mime-version :content-language:content-transfer-encoding; bh=anZc+ZHg1oPpaU7VaV0A0lyHjTHS0oaPO60MU3OXFLc=; b=cRvbmK5U3LhxqylcXdpYS6UWZcMWkdrKb0Q16vXXxe1kYZ1XUIDHD/YIQH4KrmydvP bqEc9kgT/lRniPTUj0MKnRrK1RuI41/2E52HA3DNTBbKH+Hnzfw3ajLGSrZ/5ekbLEfc luOGrq9x/h58VYtnWymWSgIAi2ikYeVl8NtMx7vXDTxMfJFM0ZGA87ofG2Z+xkE/mKxE 2jlYNNaIHIDQ6bMU029Uzyfv/PuGybj/LO9ovZmesstzK12GyeETggQh7X0zc2xb86Cu rf+MAMVy79OXbeZE4ou7g18UMNkkUDKIB4LUw5SCSGmTFqmFQXZFyFdJNJ/xHmQOWEs4 34Bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:subject:to:message-id:date:user-agent :mime-version:content-language:content-transfer-encoding; bh=anZc+ZHg1oPpaU7VaV0A0lyHjTHS0oaPO60MU3OXFLc=; b=jqBypa9sxpTn9Z91oziavhcMJ2b5kjkAJ0HgJzVLGGZljH4jeroGUKEKao/CaaUUyS I2r9qtsXd4OP6Vh+z8GF2br1c5kfmLLv4vyAs1KpGRQ5Wv9iaVHOKgO8PMSurgrwCVlz alOwFcqMy+23TvCWLfJdWraqjMBOrDlO2Z7T8lmRqsMP3wk1GDqvZc7l5LEEj4S8+JoG GtOd7+alb2nv3NI4vOUy3GShjrmNm1HIfRVE/9E0/kB9RXaFcwiCWhz1ptRhBvAkVNCI vTF/NT10AFtBK5rY+x2Pw3iIaAQkC26ps0YJ5CPaYaJixBKRs6fzNiFWJ3h6wuddqrnA JlYQ== X-Gm-Message-State: AODbwcCIOFaLK4u5p3y9XrNyaq/DzjeBX84KI5yvzbCQcPLTeHKcUSh6 vOvqrb+XISAuIA== X-Received: by 10.28.127.10 with SMTP id a10mr6938699wmd.36.1495951589836; Sat, 27 May 2017 23:06:29 -0700 (PDT) Received: from [192.168.1.79] (124.25.176.95.rev.sfr.net. [95.176.25.124]) by smtp.googlemail.com with ESMTPSA id q195sm11017421wmd.7.2017.05.27.23.06.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 27 May 2017 23:06:28 -0700 (PDT) From: Anders Rundgren To: "pkix@ietf.org" Message-ID: <5407c048-c484-9cd0-edbf-bebb9fb996d1@gmail.com> Date: Sun, 28 May 2017 08:06:26 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: [pkix] Release Candidate - JSON Cleartext Signature X-BeenThere: pkix@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: PKIX Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 May 2017 06:06:33 -0000 I have written about this before but here is an update that may be of some interest. The IETF JOSE WG finished their work on JSON based cryptographic solutions 2015. Although a truly awesome piece of work, the JOSE WG didn't really consider systems based on JSON messaging which has lead to a bunch of external developments having one thing in common; they do not wrap messages in Base64. Anyway, I have tried (to the best of my ability...) reusing as much as possible of the JOSE stack in a recently upgraded version of JCS (JSON Cleartext Signature): https://cyberphone.github.io/doc/security/jcs.html JCS combines ES6 (JavaScript version 6) JavaScript/JSON Serialization with JWA (JSON Web Algorithms) and JWK (JSON Web Key). That is, JCS is firmly based on industry standards, only the "packaging" is special. I consider the current incarnation as ready. It already runs on some of the most popular platforms out there including Chrome, Node.js, Android *, Java *. Anders https://cyberphone.github.io/doc/security/jsonsignatures.html * With the help of a free support library