Subject: [secdir] WG summaries

From: Sean Turner <[email-masked]>
Date: Mon, 25 Jul 2011 15:51:00 -0400

Please send WG summaries to the SAAG list.

spt

---

From: Stephen Kent <[email-masked]>
Date: Tue, 26 Jul 2011 12:40:44 -0400

PKIX met once, for 2 hours, on Monday, 7/25.  About 41 people attended.

The principle discussions centered on the CAA proposal. CAA is a 
DNS-based mechanism intended to help public trust anchor operators 
detect when a CA issues a cert for a web site that should be issued 
by a different CA. There was a lively discussion about many aspects 
of CAA, dealing with topics such as how to identify the CA that 
should be issuing a cert for the web site, whether the DNS records 
used for this are to be consumed by relying parties, and how to 
explain the motivation for this effort. The author (P. Hallam-Baker) 
agreed to revise the I-D to address the points raised during these 
discussions.

The meeting finished with two presentations on docs that are being 
considered for adoption by the WG.

Thye first presentation was a proposal to extend CMC to accommodate 
scenarios in which a CA/RA generates the key pair for a client. This 
may be desired to offer better randomization for key generation, and 
to enable key escrow, e.g., in corporate environments.

The second presentation described a proposal for a new, simple cert 
enrollment protocol, based on the "simple" CMC messages, augmented to 
provide a few additional capabilities that are considered critical. 
The protocol is EST: certificate Enrollment over Secure Transport.