PKIX WG Meeting 3/17/99
Edited by Steve Kent (WG co-chair)

The PKIX WG met only once during the 44rd IETF and a approximately 200
individuals participated in these meetings.

The meeting began with a review of the status of all of the WG document,
presented by Warwick Ford, WG co-chair. The following text summarizes the

status of the documents:

PKIX COMPLETED DOCUMENTS

PKIX Cert/CRL Profile (RFC 2459)
Approved as Proposed Standard
KEA Algorithms for Profile (RFC 2528)
Approved as Informational RFC
HTTP/FTP Operations (draft-ietf-pkix-opp-ftp-http-04.txt)
Approved as Proposed Standard
LDAP V2 Operational Protocols (draft-ietf-pkix-ipki2opp-08.txt)
Approved as Proposed Standard
LDAP V2 Schema (draft-ietf-pkix-ldapv2-schema-01.txt)
Approved as Proposed Standard
OCSP (draft-ietf-pkix-ocsp-05.txt)
Approved as Proposed Standard
CMP (RFC 2510)
Approved as Proposed Standard
CRMF (RFC 2511)
Approved as Proposed Standard
Certificate Policy/Practices Guideline (RFC 2527)
Approved as Informational RFC

PKIX WORK IN PROGRESS

ECDSA Algorithms for Profile (draft-ietf-pkix-ipki-ecdsa-01.txt)
New draft to be issued for WG last call shortly
CMC (draft-ietf-pkix-cmc-02.txt)
Under WG review
Diffie-Hellman POP (draft-ietf-pkix-dhpop-00.txt)
Under WG review
Qualified Certificates (draft-ietf-santesson-qc-01.txt)
Under WG review
CMMF (draft-ietf-pkix-cmmf-02.txt)
This item to be dropped from the program
Time Stamp (draft-ietf-pkix-time-stamp-00.txt)
Under WG review
DCS (draft-ietf-pkix-dcs-00.txt)
Under WG review
Web-Based Integrated CA Services Protocol (draft-sakurai-pkix-icap-01.txt)
Submitted for WG consideration

Reports on Established Projects:

A new WG charter was presented, in draft form, which shortly will be posted
to
the mailing list. The expanded charter encompasses attribute certificates,
time stamping and notarization services, and qualified certificates.


CMC and Diffie-Hellman POP (J. Schaad-Microsoft)
The CMC draft did not meet submission deadline, but was made available to
the
list. The D-H POP draft is undergoing revision. CMC has been revised to
accommodate comments from Carlisle from the last meeting. Additional
changes
are planned, including removal of the key archival and recovery features, and
clarification of RA operations.

PKIX Roadmap (A. Arsenault-NSA)
Missed submission deadline. Undergoing revision to deal with terminology
inconsistencies, POP, adding a history of PKIX, new work items (e.g.,
qualified certificates and time stamping), explanation of name constraints for

alt name forms, path validation, etc.

Qualified Certificates (S. Santesson)
Goals of qualified certificates were reviewed. The fundamental thrust of this
work is the development of a new SubjectAltName type, for "unmistakable
identity" ID information. Attribute semantics represents the top-level
structure for the SubjectaltName, making it clear what form of ID is being
provided, e.g., national ID card or driver license. Also, this extension will
contain a registration authority field, as required by German law. A pointer
to a web site for additional info was provided (http://www.accurata.se/QC/).
Suggestion was made to consider splitting this work into two document: one
for
the new name form, and another (informational?) to explain the context for
which this new name form was devised. However, to the extent that a
qualified
certificate imposes constraints on other certificate fields, it is not clear

Data Certification and Time Stamping (R. Zuccherato-Entrust)
Data certification server I-D not recently updated, but will be soon, to
respond to comments, e.g., ASN.1 corrections and more explanatory text.
The
time stamping document also has not been updated recently, but will undergo
minor revisions, e.g., to allow for issuance of a time stamp without
submission of a hash. Unfortunately, the topics of time stamping and data
certification are rife with intellectual property claims, which may interfere
with progression of these documents. Specifically, a lawsuit has been filed
by patent holders against a company that has implemented a prior version of
this protocol. The WG chairs will work with the authors of the documents to
help resolve these issues.


Other Topics:

Progressing RFC 2459 to Draft Status (T. Polk-NIST)
Collecting inputs for (mostly) minor corrections and clarifications to this
document in anticipation of progressing this work.

OCSP Clarification (S. Kent-BBN)
Two sections of OCSP will be revised to clarify what is required of
compliant
clients and servers with respect to what keys can be used to sign OCSP
responses. Specifically, an OCSP response must be signed by either the CA
who
issued the certificate in question, by an entity who has been explicitly
delegated this authority by that CA (through direct issuance and inclusion of
a specified EKU extension), or by an entity who has been selected as
authoritative by the client. Compliant OCSP servers and clients MUST be
able
to support all three of these options.(Satisfying the third option is largely
trivial for the server, but requires a configuration capability for clients.)

Will End-Entity Certificates be Fat or Low Fat? (D. Pinkas-Bull)
Proposal to minimize the addition of extensions to EE certificates, by
moving
as much of this sort of information to CA certificates, from EE certificates.
Examples of such extension data are pointers to OCSP responders and CRL
servers, where applicable to all certificates issued by a CA.

Attribute Certificates (S. Farrell-SSE)
A kickoff announcement of this new work item. Providing pointers to work
on
attribute certificates for use with TLS, as an example.

OCSP Interoperability Testing (A. Malparni-ValiCert)
Reported on tests of seven independent implementations. All made use of
HTTP
and direct, DER encoding (not base 64). Discovered some problems, e.g., in
hash computation.

Server-based Certificate Validation (A. Malparni-ValiCert)
A suggestion to explore "outsourcing" certificate validation to a server, from
a client. Proposal is to develop a protocol between a client and the
validation server, which might be attractive when the client is not
computationally capable, or to help by centralizing administration of
certificate validation management. There are security concerns here, because
of the centralization of security function in servers.

MISPC Reference Implementation (T. Polk-NIST)
CDROM contains CA, RA, and client executable code. Represents a profile
of
2459, CMP, and CRMF. Available via web site: http://crscnist.gov/pki/mispc/

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.