Subject: [saag] (no subject)

From: Stephen Kent <[email-masked]>
Date: Thu, 13 Mar 2008 11:27:00 -0400

PKIX met once for 2.5 hours on Monday, 3.10.08, with about 60 attendees.

Four PKIX documents have received IESG approval since the last IETF 
meeting (3 of these were approved this week): 3280bis and the CMC 
trio.

There were five presentations on WG items, and five on related items.

Two existing PKIX RFCs (3279 and 4055), to align with our newly 
adopted approach to representing public key algorithms with 
parameters, are undergoing minor revisions and should be completed 
soon.

The effort to update PKIX specs to use the 1998/2002 version of ASN.1 
is progressing. Jim Schaad described the merits of one of the new 
constructs in this version of ASN.1, objects.

The trust anchor management effort was the topic of two 
presentations. The first reviewed the current version of the problem 
statement I-D, and noted the plan to abandon this document and 
transition much of the text into a requirements statement I-D. 
Questions were raised on the list about  about the relationship 
between the TAM data structures and SCVP, so the speaker presented an 
analysis of the two.  Although there is an overlap, there are enough 
differences to suggest that it makes sense to continue development of 
the TAM data structures without trying to adopt the SCVP structure in 
toto.  The second presentation described a directory-based approach 
to TA management, and compared it to the request/response protocol 
approach that has been put forth so far. Both approaches can benefit 
from a common data structure model, but each approach offers somewhat 
different functionality.

The PKI Resource Query Protocol (PRQP) was briefed for a third time. 
This protocol is slated to be an experimental RFC. and was accepted 
as a WG item (with that stipulation) as the result of a straw poll 
conducted in December.
It  may be close to a WG last call.

A discussion of the use of wildcards in DSN names in certs concluded 
with an agreement that this topic is adequately addressed in 3280bis; 
processing semantics beyond what 3280bis describes are best handled 
in the WGs responsible for the secruity protocols that allow use of 
this convention.

There was a second presentation on a proposed extension to allow a 
cert to carry pointers to other certs that have been issued to the 
same subject. Additional text in the I-D is needed to clarify some 
issues raised during Q&A, before the WG can decide if it wants to 
adopt this as a new work item.

There was a presentation on a model for issuing Traceable Anonymous 
Certificates (TACs). The model is compatible with the PKIX/X.509 cert 
format and with PKIX cert request protocols. Validation of a TAC is 
also compatible with PKIX standards. The motivation for TACs is to 
allow issuance of (EE) certs that contain a Subject name that does 
not disclose the real name of the Subject, but which can be traced to 
the real user if needed, e.g., in case of abuse by the user. The 
speaker requested feedback from PKIX members and solicited a 
co-author for the document.

Scott Rea (Dartmouth) made a very brief appeal for assistance from 
IETF PKI experts. His work is exploring how to improve the usability 
of PKIs by "ordinary" users.

The final presentation was on a proposed extension to represent 
subject clearance (of processing authorization, for devices) 
information in PK certs (vs. attribute certs). The format is one 
already defined for attribute certs  by ITU-T (and thus is in RFC 
3281), and is is used in SMIME ESS (RFC 3851). Adpproval for adoption 
of this as a WG item will be pursued on the list.