Subject: [saag] PKIX report

From: Stephen Kent <[email-masked]>
Date: Tue, 24 Mar 2009 16:27:15 -0400

PKIX Meeting report

We have one document in the RFC editor's queue and twelve I-Ds in process.

PRQP, targeted to Experimental status, will be revised one more time, 
and them move to WGLC.

Traceable Autonomous Certificates, also targeted to Experimental 
status, has been revised in response to numerous comments from David 
Cooper. It will be posted and hopefully move to WGLC next month.

The Trust Anchor management requirements document passed WGLC. The 
format for TA material and the TAMP spec are both ready for WGLC.

An initial OCSP algorithm agility I-D defines the default behavior 
for a client, and proposes additional client behavior rules to deal 
with one algorithm mismatch problem. However, SHA-1 is hardwired into 
the spec and this needs to be addressed, if only for perception 
reasons. Providing true algorithm agility here may require a more 
innovative approach, e.g., use of different port or protocol values.

RFC 3161 (Time Stamp Protocol,) will be updated to address a hash 
agility concern and to address terminology issues (to be compatible 
with ETSI documents).

David Cooper is assembling data to support advancement of RFC 5280 
to Proposed status.

The new ASN.1 draft has been revised and is ready for WGLC,  in 
parallel with a straw poll to determine whether the document should 
be Informational or Standards track.

The I-D that provides OIDs for use with DSA and ECDSA will progress 
to WGLC, despite its dependence on a FIPS (186-3) that has yet to be 
issued.

The meeting concluded with a presentation by Stefan Santesson on a 
proposal to include a PDF as a next generation logotype capability. 
The goal is to do a better job of conveying the identity of a 
certificate holder to a (human) relying party, compared to  display 
of certificate contents, etc.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 24 Mar 2009 16:48:18 -0700

I dispute the assertion that a new protocol or port # might be required for OCSP. The protocol is adequately extendable.
 
What I put in the slides was what I felt that the group had already agreed to. Since this was the first occasion where the issues had been raised, I was not proposing a solution. If it is agreed that there is a problem, there is a simple solution.

________________________________

From: [email-masked] on behalf of Stephen Kent
Sent: Tue 3/24/2009 4:27 PM
To: [email-masked]
Subject: [saag] PKIX report

PKIX Meeting report

PRQP, targeted to Experimental status, will be revised one more time, and them move to WGLC.

Traceable Autonomous Certificates, also targeted to Experimental status, has been revised in response to numerous comments from David Cooper. It will be posted and hopefully move to WGLC next month.

The Trust Anchor management requirements document passed WGLC. The format for TA material and the TAMP spec are both ready for WGLC.

An initial OCSP algorithm agility I-D defines the default behavior for a client, and proposes additional client behavior rules to deal with one algorithm mismatch problem. However, SHA-1 is hardwired into the spec and this needs to be addressed, if only for perception reasons. Providing true algorithm agility here may require a more innovative approach, e.g., use of different port or protocol values.

RFC 3161 (Time Stamp Protocol,) will be updated to address a hash agility concern and to address terminology issues (to be compatible with ETSI documents).

David Cooper is assembling data to support advancement of RFC 5280  to Proposed status.

The new ASN.1 draft has been revised and is ready for WGLC,  in parallel with a straw poll to determine whether the document should be Informational or Standards track.

The I-D that provides OIDs for use with DSA and ECDSA will progress to WGLC, despite its dependence on a FIPS (186-3) that has yet to be issued.

The meeting concluded with a presentation by Stefan Santesson on a proposal to include a PDF as a next generation logotype capability. The goal is to do a better job of conveying the identity of a certificate holder to a (human) relying party, compared to  display of certificate contents, etc.

---

From: Stephen Kent <[email-masked]>
Date: Tue, 24 Mar 2009 20:00:42 -0400

At 4:48 PM -0700 3/24/09, Hallam-Baker, Phillip wrote:
>I dispute the assertion that a new protocol or port # might be 
>required for OCSP. The protocol is adequately extendable.
>
>What I put in the slides was what I felt that the group had already 
>agreed to. Since this was the first occasion where the issues had 
>been raised, I was not proposing a solution. If it is agreed that 
>there is a problem, there is a simple solution.

Phil,

The PKIX report is a summary of the meeting minutes. I suggest you 
dead the PKIX minutes for a more complete description of the 
discussion that accompanied Stefan's presentation of your slides. For 
example, the minutes note that Paul Hoffman suggested the use of 
different ports or a different protocol number, as a possibly 
preferable way to address the algorithm agility concerns (vs. adding 
OCSP extensions). Russ emphasized the need to address the dependence 
on SHA-1 sooner rather than later.

Steve

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 24 Mar 2009 17:52:51 -0700

I read the minutes, the summary is quite a bit different. 

From: Stephen Kent [mailto:[email-masked]]
Sent: Tue 3/24/2009 8:00 PM
To: Hallam-Baker, Phillip
Cc: [email-masked]
Subject: RE: [saag] PKIX report

Phil,

The PKIX report is a summary of the meeting minutes. I suggest you dead the PKIX minutes for a more complete description of the discussion that accompanied Stefan's presentation of your slides. For example, the minutes note that Paul Hoffman suggested the use of different ports or a different protocol number, as a possibly preferable way to address the algorithm agility concerns (vs. adding OCSP extensions). Russ emphasized the need to address the dependence on SHA-1 sooner rather than later.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Tue, 24 Mar 2009 21:00:02 -0400

>I read the minutes, the summary is quite a bit different.

The summary conveyed the essential points, i.e., the principle points 
that the slides conveyed and the primary audience responses to the 
slides.

Steve