Subject: Re: Validation policy in DPV/DPD rqmts

From: Stephen Kent <[email-masked]>
Date: Fri, 1 Mar 2002 11:19:47 -0500

At 2:56 PM -0800 2/28/02, todd glassey wrote:
>Steve
>
>----- Original Message -----
>From: "Stephen Kent" <[email-masked]>
>To: "todd glassey" <[email-masked]>
>Cc: <[email-masked]>
>Sent: Thursday, February 28, 2002 1:37 PM
>Subject: Re: Validation policy in DPV/DPD rqmts
>
>
>>  At 1:24 PM -0800 2/28/02, todd glassey wrote:
>>  >And Steve how many years have you been the WG Chair of this WG?
>>  >
>>  >Todd
>>  >
>>
>>  I've chaired PKIX since it's inception.
>
>My point exactly
>
>>  For comparison, the duration
>>  of my role as chair is less than the amount of time that John Linn
>>  has chaired CAT.
>
>Not a good comparison - CAT is not building technologies to be used in
>commercial transaction standards and you and your WG are, so the work PKIX
>is doing has more than just communications value, it has intrinsic value as
>part of the transaction infrastructrue itself and that is why PKIX is
>different than the other WG's.

you want PKIX to operate under different rules because you perceive 
that its standards apply to a fundamentally different constituency. 
But protocols such as SSH, SSL, S/MIME and IPsec make use of PKIX 
certs and these don't appear to fit your model of "commercial 
transaction standards."  So, the problem, in part, is that your have 
an unduly narrow view of the constituency that PKIX serves.

>  >  also chaired the PEM WG prior to PKIX, chaired
>>  the PSRG in the IRTF for about 10 years, and served on the IAB for
>>  about 10 years.
>
>with the amount of time that you have spent already in this, I have to ask -
>is this is a career for you?

I do lots of things, in addition to standards work, but I view 
standards activities as important and a worthy use of my time. Also, 
I have clients who agree and are willing to pay for me to spend the 
time on these activities. Within BBN I've provided technical 
leadership in developing several generations of network security 
devices, plus secure e-mail systems, high assurance crypto modules, 
CA technology, etc. I also am known as one of the senior Internet 
wine experts and engage in serious nature photography, in my spare 
time ...

>  >
>>  There are no term limits for WG chairs.
>
>WG Chairs are also not voted positions which is equally disturbing and why
>is that do you think? They are in virtually every other formal standards org
>on the planet. So I have to ask - Why not the IETF? is it beyond
>accountability here.

These other standards bodies have formal membership requirements and 
thus have a basis for voting.  the IETF does not, by its own choice, 
vote on these matters.  if you are unhappy with this arrangement, 
perhaps you should consider directing your energies to other 
standards bodies.

>  > If you want to suggest term
>>  limits, bring the topic up on POISED, where the topic is within scope.
>>
>
>I have done exactly that - but POISED has been shut down so I have no choice
>but to bring my petitions for reform of the IETF (and thus this WG) back
>inside this WG...  see the http://www.ietf.org/html.charters/OLD/index.html
>link for evidence of this.
>

See Paul's message.

Steve

---

From: "todd glassey" <[email-masked]>
Date: Fri, 1 Mar 2002 12:30:25 -0800

Steve this is pointless to argue on this list about. I disagree with what
you are doing and believe that your impressive resume is being wasted in
your current role.

> standards activities as important and a worthy use of my time.

I would agree.

> Also,
> time on these activities.

Which makes you an obvious resource for an organization like the IETF - its
just that you have sat for 7 years here in PKIX and we need some fresh
blood.

I suggest - and this is not a joke- that we petition the IESG and IAB to
make you the "Chief Scientist of the Internet" and create a specific and
permanent role for you there. This is not a joke - really it isn't. I see
this as one of the potentially most important roles in the IESG and IETF.
And for you to follow in Vint cerf's or John Postels shoes would be cool to
I think...

Steve this is not a slam on you personally - of that you are brilliant,
there is no doubt, but enough is enough. You nurtured (or kicked and
dragged) PKIX from its inception to where it is now, and it needs some new
blood to get it to the next level.

> Within BBN I've provided technical

See what I mean.

> perhaps you should consider directing your energies to other

No Steve, Sooner or later you will have to admit that this is not 1974 and
that what the IETF was founded on was a need to get as many protocols out
there as possible as fast as possible to enable the development of the
Internet. The the Internet is a long way from where it was in 1974... no
more Honeywell IMPS. This is a key issue now that the internet extends into
Millions of homes and virtually every major or even small business in  the
mechanized world... (OK so its not all of them yet, but its too many to just
ignore).

Now the IETF's focus needs to shift to not just producing protocols but to
producing the right ones.  And that's going to take partnering with other
standards orgs formally and getting their input when we design core
functionality into the work we do. Its also going to mean getting many more
fledging protocols into the shoot, and that is what the current process
stifles and that a better disclosure mechanism is needed too. You know USE
MODELS (note that I spelled it in caps just for you, too!).

> >inside this WG...  see the
http://www.ietf.org/html.charters/OLD/index.html
> >link for evidence of this.

I have and according the the IETF's website Paul's wrong, the WG is listed
as "completed"

Err unless of course its a typo.

---

From: Stephen Kent <[email-masked]>
Date: Fri, 1 Mar 2002 16:17:45 -0500

>you are doing and believe that your impressive resume is being wasted in

Yes, Todd, it is pointless, so I'll stop responding as of now.

Steve

---

From: "Anders Rundgren" <[email-masked]>
Date: Sat, 2 Mar 2002 15:12:40 +0100

Well, if we are going to discuss the validity of certain PKIX work,
may I question this list how you plan to differentiate DPV/DPD
with XKMS?

To me it seems that the "industry" have no interest to support two
similar schemes, so PKIX is probably too late with this proposal as the
"competitor" is already running.  If the "competitor" lacks some
features, I think the "industry" will do a "revision", rather than
begin toiling with something new.  Particularly as the "industry" has
indicated that they want to work with XML, and only use ASN.1
where it is necessary for historical reasons like for certificates.

Anders

---

From: "Roberto Opazo Gazmuri" <[email-masked]>
Date: Sun, 3 Mar 2002 13:19:27 -0300

What is the relation of these comments with DPV/DPD?

I would like to have a chance of a quick filter any time I receive a mail.
That is the idea of having a list and a thread.

If there is no list for political discussion, I ask you at least to use a
different tread. Other way you are degrading the level of this discussion.

Political discussion is valid and may be necessary, but I believe "Re:
Validation policy in DPV/DPD" is not the place for that.

Thanks,

Roberto

> -----Mensaje original-----
> De: [email-masked] [mailto:[email-masked]]En
> nombre de todd glassey
> Enviado el: viernes, 01 de marzo de 2002 17:30
> Para: Stephen Kent
> CC: LISTS - IETF-PKIX
> Asunto: Re: Validation policy in DPV/DPD rqmts
>
>
>

---

From: "todd glassey" <[email-masked]>
Date: Sun, 3 Mar 2002 10:02:05 -0800

The problem is Roberto that this management team does not want any criticism
of its actions in any form. The bottom line is that they have screwed up by
refusing to pay attention  to how this technology is to be specifically
used, i.e. what it does and doesn't do, and without this element brought
into the mix - all you get is political arguments like the one that you have
asked not to be a part of.

As to a filter - that is the issue with EMail - you never know what it is
until you open it. The problem with a separate political thread address
would be that no one would read it if it sat by itself alone. That is the
problem and the joy of the IETF's architecture.

Todd

----- Original Message -----
From: "Roberto Opazo Gazmuri" <[email-masked]>
To: "todd glassey" <[email-masked]>; "Stephen Kent"
<[email-masked]>
Cc: "LISTS - IETF-PKIX" <[email-masked]>
Sent: Sunday, March 03, 2002 8:19 AM
Subject: Political Discussion

---

From: Rich Salz <[email-masked]>
Date: Sun, 03 Mar 2002 21:22:18 -0500

> of its actions in any form.

That's not accurate.  Stephen, in particular, has spent quite some time
explaining how and why you're in the minority opinion.  If anything, an
honest person would have to see that you're the unwilling one.

	/r$
-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com

---

From: "todd glassey" <[email-masked]>
Date: Sun, 3 Mar 2002 20:31:20 -0800

No Rich - what they would have seen is that there are approximately 10
people that form the core of the PKIX WG and that there is a tendency to let
that process run status quo. You would also find that the records of this
WG's ability to come to completion on any number of protocols has been
fraught with infighting and other "stumbling blocks".

The concept that it took this WG 5+ years to deal with a time stamping
solution is a testimony to this WG's capabilities and its management in
particular. You as an "elder" of the process also bear some responsibility
for that as well. But predominetently its the WG Chairs.

No Rich, this has been about what PKIX has accomplished, what it is trying
to accomplish and what it should accomplish before shutting down as
completed, and I guess that my take is that PKIX's only reason for existing
is for commercial enablement. End-user authentication is already complete so
there is really no purpose in kicking that dead horse.

Todd
----- Original Message -----
From: "Rich Salz" <[email-masked]>
To: "todd glassey" <[email-masked]>
Cc: "Roberto Opazo Gazmuri" <[email-masked]>; "Stephen Kent"
<[email-masked]>; "LISTS - IETF-PKIX" <[email-masked]>; "Al Arsenault"
<[email-masked]>
Sent: Sunday, March 03, 2002 6:22 PM
Subject: Re: Political Discussion

---

From: Michael Ströder <[email-masked]>
Date: Mon, 04 Mar 2002 11:34:24 +0100

todd glassey wrote:
> until you open it.

I disagree. I strongly suggest that people stay on topic if someone started 
a thread with a certain topic. If the topic changes during discussion the 
subject should be changed. That's the only solution for an efficient 
handling of discussions on mailing lists.

> The problem with a separate political thread address
> would be that no one would read it if it sat by itself alone.

You're telling us that you want to mix your personal political opinions into 
other discussion threads just to make us noticing them? With this attitude 
your postings are getting very close to my kill file.

> That is the

If you want to do politics then be political in the right place. Make the 
IETF or your government/company/whatever aware of what you think the problem 
is. But do not mess up technical discussions!

Ciao, Michael.

---

From: "todd glassey" <[email-masked]>
Date: Mon, 4 Mar 2002 05:24:49 -0800

So then are you proposing a PKIX etiquette change wherein when the subject
content is going to change on the technical level then the RFC822 subject
should change too.

Just so I am real clear on this  - and  I have to ask - should this same
rule apply to technical changes in a subject thread too or only when the
subject becomes political? Say that someone changes the technical aspects of
a conversation to some other technological discussion  - You see because any
change in any thread can be construed as violating this same edict. So where
do you draw the line?

What I am asking Michael - is how to you would suggest differentiating
particular technical discussions (i.e ones that you are interested in
participating in) from any other.

Todd Glassey

---

From: "Peter Hesse" <[email-masked]>
Date: Mon, 4 Mar 2002 10:55:57 -0500

Todd,

It is a simple courtesy to change the subject line of the posting when the
subject of the message changes.  It happens quite often.  It has happened a
few times in fairly recent memory in regards to your postings-- subject
lines such as "Changing the IETF (was Re: Validation policy in DPV/DPD
rqmts)" or "Motions before the WG - Was Re: Software for PKI" or "PKIX
reform issues - Was Re: I-D ACTION:draft-ietf-pkix-okid-00.txt".  It
commonly changes in the course of technical discussions as well--subjects
such as "XKMS, Was RE: Software for PKI", or "Copying smart cards.  Was: A
PKI Question: PKCS11-> PKCS12".

I am unsure of what purpose you are trying to achieve by repeatedly posting
calls for the WG co-chair's head in a technical working group.  If there
were significant support for your position, you probably would have heard it
by now.  I will now join the chorus of people asking that you pursue this
via alternate means than posting to this list.  You can, of course, post
whatever you wish--in which case I ask as Michael did that you provide the
common courtesy of a subject line change.

Thanks,

--Peter Hesse

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of todd glassey
> Sent: Monday, March 04, 2002 8:25 AM
> To: [email-masked]
> Cc: LISTS - IETF-PKIX
> > > As to a filter - that is the issue with EMail - you never
> know what it
> is
> > > until you open it.
> >
> > You're telling us that you want to mix your personal
> political opinions
> into

---

From: Stephen Kent <[email-masked]>
Date: Mon, 4 Mar 2002 17:14:59 -0500

>where it is necessary for historical reasons like for certificates.

Anders,

The WG discussed use of XML for DPV/DPD over a year ago and decided 
to pursue the work using ASN.1 syntax. The first version of SCVP 
offered both syntaxes; the current one does not.

As you and I have discussed in the past on the list, PKIX does not 
select work items based on what "the industry" has indicated is the 
future, but rather based on what members of the WG (who are 
individuals, not industry representatives) choose to pursue. As I'm 
sure you know, much of what is promoted as industry trends are really 
marketing/PR efforts by vendors trying to influence other vendors and 
consumers to adopt selected technologies, approaches, etc.  XKMS may 
or may not fall into this category; I don't mean to judge it in the 
context of this discussion. The XKMS authors chose to pursue its 
standardization in another forum, W3C, so it's not something PKIX 
needs to deal with at this time.

For historical perspective, if the IETF believed what the "industry" 
said the major trends were in the past (as widely reported and 
endorsed by trade magazines and in industry conferences), we would 
all be communicating via OSI protocols over ATM, or, more recently, 
over 3G wireless!

Steve