Subject: [saag] Fwd: Call for Participation: OASIS Key Management Interoperability Protocol (KMIP)

From: Russ Housley <[email-masked]>
Date: Wed, 04 Mar 2009 16:17:21 -0500

People on this list make be interested in this proposed OASIS Technical
Committee.

Russ

-----Original Message-----

From: Mary McRae

To: [email-masked]; [email-masked]

CC: [email-masked]

Sent: Wed Mar 04 15:17:07 2009

Subject: Call for Participation: OASIS Key Management Interoperability
Protocol (KMIP) Technical Committee

To:  OASIS members & interested parties

A new OASIS technical committee is being formed. The OASIS
Key Management

Interoperability Protocol (KMIP) Technical Committee has been proposed
by

the members of OASIS listed below. The TC name, statement of purpose,
scope,

list of deliverables, audience, and language specified in the proposal
will

constitute the TC's official charter. Submissions of technology for

consideration by the TC, and the beginning of technical discussions,
may

occur no sooner than the TC's first meeting.

The eligibility requirements for becoming a participant in
the TC at the

first meeting (see details below) are:

(a) you must be an employee of an OASIS member organization
or an

individual member of OASIS, and

(b) you must join the Technical Committee, which members may
do by using

the "Join this TC" button on the TC's public page at
[a].

To be considered a voting member at the first meeting, you
must:

(a) join the Technical Committee at least 15 days prior to
the first

meeting; and

(b) you must attend the first meeting of the TC, at the time
and date

fixed below.

Of course, participants also may join the TC at a later time. OASIS and
the

TC welcomes all interested parties.

Non-OASIS members who wish to participate may contact us
about joining

OASIS [b]. In addition, the public may access the information
resources

maintained for each TC: a mail list archive, document repository and
public

comments facility, which will be linked from the TC's public home page
at

[a].

Please feel free to forward this announcement to any other
appropriate

lists. OASIS is an open standards organization; we encourage your

participation.

Regards,

Mary

---------------------------------------------------

Mary P McRae

Director, Technical Committee Administration

OASIS: Advancing open standards for the information society

email: [email-masked]

web:

www.oasis-open.org

phone: 1.603.232.9090

[a]

http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=kmip

[b] See

http://www.oasis-open.org/join/

CALL FOR PARTICIPATION

OASIS Key Management Interoperability Protocol (KMIP) Technical
Committee

Statement of purpose:

The KMIP Technical Committee will develop specification(s) for the

interoperability of key management services with key management clients.
The

specifications will address anticipated customer requirements for
key

lifecycle management (generation, refresh, distribution, tracking of
use,

life-cycle policies including states, archive, and destruction), key

sharing, and long-term availability of cryptographic objects of all
types

(public/private keys and certificates, symmetric keys, and other forms
of

"shared secrets") and related areas.

Scope:

The initial goal is to define an interoperable protocol for standard

communication between key management servers, and clients and other
actors

which can utilize these keys. Secure key management for TPMs
(Trusted

Platform Modules) and Storage Devices will be addressed. The scope of
the

keys addressed is enterprise-wide, including a wide range of actors:
that

is, machine, software, or human participants exercising the protocol
within

the framework. Actors for KMIP may include:

* Storage Devices

* Networking Devices

* Personal devices with embedded storage (e.g. Personal Computers,
Handheld

Computers, Cell Phones)

* Users

* Applications

* Databases

* Operating Systems

* Input/Output Subsystems

* Management Frameworks

* Key Management Systems

* Agents

Out of scope areas include:

* Implementation specific internals of prototypes and products

* Multi-vendor Key Management facility mirrors or clusters

* Definition of an architectural design for a central enterprise key

management or certificate management system other than any necessary
models,

interfaces and protocols strictly required to support
interoperability

between Actors in the multi-vendor certificate and key management
framework.

* Framework interfaces not dedicated to secure key and certificate

management

* Certain areas of functionality related to key management are also
outside

the scope of this technical committee, in particular registration of

clients, server-to-server communication and key migration.

* Bindings other than tag-length-value wire protocol and XSD-based

encodings.

List of deliverables:

The deliverables for the KMIP Technical Committee are anticipated to
include

the following:

* Revised KMIP Specification v0.98. This provides the normative
expression

of the protocol, including objects, attributes, operations and other

elements. A Committee Specification is scheduled for completion within
12

months of the first TC meeting.

* Revised KMIP Usage Guide v0.98. This provides illustrative and
explanatory

information on implementing the protocol, including authentication
profiles,

implementation recommendations, conformance guidelines and security

considerations. A Committee Specification is scheduled for completion
within

12 months of the first TC meeting.

* Revised KMIP Use Cases and Test Cases v0.98. This provides sample
use

cases for KMIP, test cases for implementing those use cases, and examples
of

the protocol implementing those test cases. A Committee Specification
is

scheduled for completion within 12 months of the first TC meeting.

* Revised KMIP Frequently Asked Questions. This document provides
guidance

on what KMIP is, the problems it is intended to address and other
frequently

asked questions.

KMIP, as defined in the above deliverables, will be scoped to include
the

following:

1) Comprehensive Key and Certificate Lifecycle Management Framework

A. Lifecycle Management Framework to Include:

a) Provisioning of Keys and Certificates

i) Creation

ii) Distribution

iii) Exchange/Interchange

iv) Auditing

b) Reporting

c) Logging (Usage tracking)

d) Backup

e) Restore

f) Archive

g) Update/Refresh

h) Management of trust mechanisms between EKCLM
(Enterprise Key and

Certificate Lifecycle Management) actors only as necessary to support
EKCLM

B. Comprehensive Key and Certificate Policy Framework to
include:

a) Creation

b) Distribution

c) Exchange/Interchange

d) Auditing

e) Reporting

f) Logging (Usage tracking)

g) Backup

h) Restore

i) Archive

j) Update/Refresh

k) Expectation of Policy Enforcement

i) At endpoints

ii) At Key Manager

iii) At intermediaries between endpoints and Key
Manager facility

C. Interoperability between Machine Actors in performing all
aspects of A)

and B), and addressing:

a) pre-provisioning and late binding of keys and
certificates

b) support for hierarchical or delegation or direct
models

c) actor discovery and enrollment as necessary to
support ECKLM

d) key, certificate and policy migration

e) audit and logging facilities

D. General Capabilities may include:

a) Secure and Robust Mechanisms, Techniques, Protocols
and Algorithms

b) Recovery capabilities, only as needed by
interoperable interfaces,

anticipating power failure, or other common failures of automated
Actors

c) Forward compatibility considerations

d) Interface to Identity Management facilities as
necessary for A) and

B)

e) Interface to Enterprise Directory facilities as
necessary for A) and

B)

KMIP TC will also support activities to encourage adoption of KMIP.
This

would likely include:

Interoperability sessions to test effectiveness of the specification

Reference implementations of KMIP functionality

IPR Mode under which the TC will operate:

The KMIP TC is anticipated to operate under RF on RAND.

Anticipated audience or users:

KMIP is intended for the following audiences:

* Architects, designers and implementers of providers and consumers
of

enterprise key management services.

Language:

Work group business and proceedings will be conducted in
English.

Non-normative information

Identification of similar or applicable work:

Similar work is currently underway in several other organizations:

* OASIS EKMI TC. We see KMIP TC as addressing a broader scope than
the

primarily symmetric key focused EKMI, providing a more comprehensive

protocol in which SKSML can potentially participate.

* IEEE P1619.3. We see KMIP TC as addressing a broad scope than the

primarily storage-related P1619.3.

* TCG Infrastructure Working Group. We see KMIP TC as addressing a
broader

scope than the primarily TPM related TCG IWG.

* IETF Keyprov. We see KMIP TC as addressing a broader scope than
the

primarily mobile-related IETF Keyprov.

KMIP TC intends to establish liaisons with each of these organizations
and

may also establish liaisons with other organizations that are identified
as

focused on similar or applicable work.

Date, time, and location of the first meeting:

The date for the first meeting is April 24th 2009, from 9am PDT until
5pm

PDT, to be held as a Face to Face meeting in San Francisco in
conjunction

with the RSA Conference. Call-in facilities will be provided for
those

unable to attend in person.

Projected on-going meeting:

Conference calls will be held weekly, to be sponsored by one or more of
the

companies proposing the KMIP TC. These conference calls will be
complemented

by the following:

* Face to face meetings as determined by the KMIP TC.

* General communication will be via email reflectors with archiving
provided

by the KMIP TC.

* KMIP TC progress will be communicated via a KMIP TC web page.

* The KMIP TC will communicate (conference calls, joint working
sessions,

etc.) with external groups as appropriate.

* The KMIP TC will communicate (conference calls, joint working
sessions

etc.) with internal OASIS groups (other TCs) as appropriate.

Names, electronic mail addresses, and membership affiliations of at
least

Minimum Membership:

Robert Griffin, EMC/RSA, [email-masked]

Robert Philpott, EMC/RSA, [email-masked]

Mark Schiller, HP, [email-masked]

Jishnu Mukerji, HP, [email-masked]

Anthony Nadalin, IBM, [email-masked]

Robert Haas, IBM, [email-masked]

Walt Hubis, LSI, [email-masked]

Jon Geater, Thales, [email-masked]

Marcus Streets, Thales, [email-masked]

Martin Skagen, Brocade, [email-masked]

Karla Thomas, Brocade, [email-masked]

Scott Kipp, Brocade, [email-masked]

Subhash Sankuratripati, NetApp, [email-masked]

Paolo Bezoari, NetApp, [email-masked]

Dave B Anderson, Seagate, [email-masked]

Landon Curt Noll, Cisco, [email-masked]

The name of the Convener who must be an Eligible Person:

Robert Griffin (EMC)

The name of the Member Section with which the TC intends to affiliate,
if

any.

The KMIP TC intends to affiliate with the IDtrust Member
Section.

List of contributions of existing technical work that the proposers

anticipate will be made to this TC:

* KMIP Specification v0.98

http://xml.coverpages.org/KMIP/KMIP-v0.98-final.pdf

* KMIP Usage Guide v0.98

http://xml.coverpages.org/KMIP/KMIP-UsageGuide-v0.98-final.pdf

* KMIP Use Cases and Test Cases v0.98

http://xml.coverpages.org/KMIP/KMIP-UseCases-v0.98-final.pdf

* KMIP FAQ

http://xml.coverpages.org/KMIP/KMIP-FAQ.pdf

Frequently Asked Questions (FAQ) document:

See preceding list of contributions.

Proposed working title and acronym for the specification(s) to be
developed

by the TC.

* KMIP Specification

* KMIP Usage Guide

* KMIP Use Cases and Test Cases

* KMIP FAQ

---------------------------------------------------------------------

This email list is used solely by OASIS for official consortium
communications.

Opt-out requests may be sent to [email-masked], however,
all members are strongly encouraged to maintain a subscription to this
list.