Subject: CMC Update

From: Michael Myers <[email-masked]>
Date: Thu, 12 Nov 1998 08:24:53 -0800

All,

At the Chicago meeting, some issues were raised from the floor regarding
CMC (in WG Last Call).  Follow-up uncovered additional problems, leading
the CMC authors to initiate a comprehensive joint review of the protocol's
requirements and mechanisms.  The draft "draft-ietf-pkix-cmc-02.txt" is the
outcome of our working sessions.  In summary, this draft:

1. Has been reorganized to better reflect its role in meeting user needs,
especially those of the S/MIME, IPSEC and TLS communities. Refinements in
support of dual key operations and automated administration were considered
essential.

2. Reduces the need for readers to refer to multiple documents by replacing
references to CMMF with direct specification of functional equivalents.

3. Maintains interoperability with CRMF via a requirement that CRMF MUST be
implemented at the server while it MAY be implemented in the client.

4. Reinstates the requirement to implement support for standalone PKCS#10,
which had been agreed to long ago by the working group, and was
inadvertently dropped.

5. Clarifies use of the protocol in conjunction with the role of
Registration Authorities.

6. Refines proof of possession requirements and mechanisms to improve
implementability.

7. Proposes an industry-standard method of proving identity based on a
shared secret between the certificate requestor and the verifying authority.

8. Facilitates (optional) end-user emergency key recovery mechanisms
against several constraints and key generation options.

We believe that this draft is a much-improved work product and invite your
comments. A temporary copy is available at
<http://www.imc.org/ietf-pkix/temp-cmc-02.txt>. After the Internet Drafts
editor has posted it to the official drafts directory, it will be available
from the URL that the most up-to-date version is always available, which is
<http://www.imc.org/draft-ietf-pkix-cmc>.

Michael Myers   (VeriSign)			
Xiaoyi Liu      (Cisco)
Barbara Fox     (Microsoft)				
Jeff Weinstein  (Netscape)

---

From: Al Arsenault <[email-masked]>
Date: Wed, 18 Nov 1998 07:46:55 -0500

In describing the new version of the CMC document, Michael Myers wrote that
version 2

>references to CMMF with direct specification of functional equivalents.

So - I suggest that we now kill the CMMF document, as it serves no useful
purpose.

Approximately one year ago, at the Washington IETF, it was announced that
the CRMF and CMMF documents would be developed to contain the message
formats  to be used by cert management protocols.  This was one of the
resolutions to the CMP vs. then-CRS (now CMC) issue.  It was stated that
the best way to proceed was to specify the common message formats first,
and then let any protocol you wanted to use reference those formats.

Now, however, we find that all of the formats defined in CMMF are
explicitly contained in both CMP and CMC.  Thus, the message format
definitions in CMMF are redundant, and that document serves no apparent
purpose.  (Unless, of course, you want to allow for the possibility that
somebody will develop a third protocol for certificate management, and use
those formats, but I really hope that nobody gets that bright idea.)

So, given this, can we now just let the current CMMF draft expire, and not
do any further work on it?  

(Warning:  hidden agenda alert:  I'm also going to propose down the road
that we take the CRMF definition, put it in CMP and CMC, and let the CRMF
I-D die.  I've never understood why, other than timing concerns, that
occupied a whole different document.)

Comments, dissenting opinions, etc., are welcome.

				Al Arsenault

-- these are my opinions only. They do not necessarily reflect the 
opinions of my employer, or of any other organization with which I have a 
relationship.

-- these are my opinions only. They do not necessarily reflect the 
opinions of my employer, or of any other organization with which I have a 
relationship.