Subject: draft meeting minutes, please comment

From: Stephen Kent <[email-masked]>
Date: Wed, 21 Mar 2001 09:44:39 -0500

PKIX WG Meeting 3/20-01
Edited by Steve Kent (WG co-chairs)

The PKIX WG met once during the 50th IETF. A total of approximately 
155 individuals participated in the meeting.

Tim quickly reviewed the agenda and document status, noting that 
there are many  I-Ds in progress. (see slides)

Two new RFCs:
	RFC 3029	Data Validation and Certification Server (Experimental)
	RFC 3039	Qualified Certificates (Proposed Standard)

In the IESG Review Process:
	Timestamp Protocol
		(missing IANA considerations section)
	Attribute Certificate Profile
		(missing IANA considerations section and another issue)

Soon to be Submitted to IESG:
	PKIX Roadmap (Informational)
	Permanent Identifier (Experimental?)
	Repository Locator Service (Experimental)

In WG Last Call:
	Son-of-RFC 2459
	Public Algorithms and Identifiers
	CRMF & CMP
CMP/CRMF Interoperability results?

Close to WG last call:
	OCSPv1 bis

Evolving Specifications
	Technical NR (being revised)
	OCSPv2
	Additional LDAP Schema
	Attribute Certificate Acquisition Protocol
	CP/CPS Framework
	DPD/DPV requirements

New Work
	Impersonation Certificates
	Group Name

Status of RFC 2459bis- Russ Housley (RSA Labs)
	Fixed path length computation. Fix "who can issue CRLs" 
problem by allowing a CA certificate to contain EITHER the 
KeyCertSign OR cRLSign bits. Thus only CAs (syntactically speaking) 
issue CRLs, bit it allows creation of an entity that is marked as a 
CA, but which is restricted to signing CRLs. (slides)

OCSPv1 - Ambarish Malpani (ValiCert)
	Moving OCSPv1 to Draft Standard. Interoperability efforts 
going well, including PKI Forum work. Also some minor clarifications 
of the text. Make RSA mandatory, drop required support for DSA. 
(slides)

CMC - Jim Schaad (???)
	Updating document, symmetric key distribution ambiguity, 
minor editorial corrections. Hope to complete updates and get 
interoperability test data for progression to Draft in about 6 
months. (no slides)

Impersonation Certificates - Stephen Tuecke (Argonne Labs)
	Renamed proxy certificates. Motivation is single signon 
delegation support. Intent is to bind a new key pair to a subject alt 
name and to an extension that labels this as a proxy certificate. 
However, there are conflicts between this proposal and the existing 
and revised profile (and X.509). Specifically, the EE is acting like 
a CA, syntactically, but the EE certificate does not have the 
basicConstraints flag set to mark it as a CA. Thus the path 
validation algorithm would reject these proxy certificates. (slides)

DPD/DPV Requirements - Steve Kent (BBN)
	Presentation described revised proposals for DPD and DPV 
requests and responses, using ASN.1 strawmen examples. Ended with a 
plan for progress on the topic, resulting in selection of a protocol 
before the next IETF meeting in August.  Steve Farrell expressed 
concern that the DPD request is too complex, contains unnecessary 
controls, based on a model that does not require returned paths to be 
ones that will necessarily be able to be validated by the client. 
(slides)

OCSPv2 - Michael Myers (VeriSign)
	Expansion of OCSPv1 to create a candidate protocol for the 
DPD & DPV functions. Includes a facility to support nonce relay, by 
concatenating new nonces with old ones. Emphasis on reuse of OCSPv1 
structures wherever possible, e.g., with regard to status responses. 
There are fewer controls on path construction for DPD vs. DPD, based 
on assumptions about relative capability of clients and on perception 
of likely complexity of certificate graphs. (slides)

DPD/DPV - Denis Pinkas (Bull)
	For DPV, major focus is valid/invalid response, plus optional 
proof returned when needed, e.g., for NR. Can have a small response 
with Y/N response and hash as a link to the supporting info. Suggests 
just a single path and revocation status data should be returned. For 
DPD need a path returned always, unlike DPV. Suggests partial 
revocation status data might be returned, if complete data not 
available. (Both DPD + DPV specify the target by either supplying a 
certificate or an Issuer name and serial number.) Suggestion that CA 
and EE certificates may not want the same revocation status data, but 
Mike Myers disagrees with this distinction. Proposal for partial 
responses, e.g., incomplete paths. Argument against DPV support for a 
posteriori validation when the time frame is outside of the 
certificate validity period. Finally, argues for stateless servers, 
i.e., no retry facility in DPD. (slides)

SCVP - Ambarish Malpani (ValiCert)
	Removed XML syntax, and will use CMS as secure enveloping 
mechanism. (one slide)

Group Name - Mike St. Johns (??)
	Motivation is to support a commonly employed OS naming 
convention in EE certificates, instead of having to map from a DN. 
Possible uses in attribute certificates too. Currently proposed as an 
OtherName but open to suggestions for encoding. (slides)

Policy Requirements for TSAs - Denis Pinkas (Bull)
	This is a new ETSI work item. Will complement existing ETSI 
standards on electronic signature formats, qualified certificates, 
and a document addressing policy for CAs issuing qualified 
certificates. TSA policy will be based on RFC 2527 and ETSI 456. 
Welcome participation and inputs from PKIX and SMIME WG members. 
(slides)

---

From: Michael Helm <[email-masked]>
Date: Fri, 23 Mar 2001 11:58:20 -0800

> PKIX WG Meeting 3/20-01
  ...
> Evolving Specifications
        ...
> 	CP/CPS Framework

Tim Polk said a few brief words about this, but I don't 
have any more in my notes than are in the minutes.
I couldn't find a draft in the ietf site or in my
non-deleting mirror.   Is there anything out there?
We're working with the earlier framework & interested
in changes.  Thanks, ==mwh
Michael Helm
ESnet/LBNL

---

From: Juan Carlos Pérez Aguayo <[email-masked]>
Date: Fri, 23 Mar 2001 16:47:37 -0400

I'am working with the RFC2527 and I'am very interested in changes too.

Thanks

Juan Carlos

-----Original Message-----
From: Michael Helm [mailto:[email-masked]]
Sent: Viernes, 23 de Marzo de 2001 15:58
To: [email-masked]
Subject: Re: draft meeting minutes, please comment 

  ...
        ...