Subject: [pkix] agenda topics?

From: Stephen Kent <[email-masked]>
Date: Thu, 21 Jun 2012 10:33:26 -0400

Folks,

Please send requests for agenda time to Stefan and cc me.

Thanks,

Steve

---

From: Anders Rundgren <[email-masked]>
Date: Sun, 24 Jun 2012 11:33:30 +0200

I won't be there but those who are still need to come up with
a reasonable explanation to why they propose yet another
client-centric certificate enrollment system when essentially
all Internet services are server-centric.

--anders

---

From: Stephen Kent <[email-masked]>
Date: Mon, 25 Jun 2012 14:44:27 -0400

>all Internet services are server-centric.

Anders,

The subject of the message who a request for slots.  Since, as you noted,
you are not attending, you need not reply.

Also, your repeated messages about what you think are the most 
important problems to be addressed, accompanied by no I-Ds, are not 
helpful. If you persist in such postings, I'll remove you form the 
list.  Clear?

Steve

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 26 Jun 2012 07:28:11 +0200

> helpful. If you persist in such postings, I'll remove you form the 

Steve,
If it makes you happy, feel free removing me from the list.

My only intent was trying to ignite an interest in creating a
credential enrollment standard for the *mass-market*.  Since we
didn't even managed getting an *open discussion on the requirements*,
the PKI-using-community essentially has nothing to do but waiting
for Google to present a de-facto standard.  I guess it will come
somewhere between Android V5 and V6. Right, Wan-Teh? :-)

This might actually be a better idea [1] than investing in 150p+
difficult-to-read I-Ds that may never be adopted by the platform vendors.

Regarding CMC/SCEP/CMP/EST they are all based on what I call "Fat Crypto".
This is (as I have described in great length), incompatible with E2ES
(End-to-End Security) and security hardware.  Security hardware is
already available in many popular Android devices, is announced for
Windows Phone 8, and rumored to be a part of iPhone 5.

Anders

1] The IETF KEYPROV effort which several PKIXers participated in, took forever
and didn't go anywhere. Protocol standardization is indeed a daunting task.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 26 Jun 2012 07:48:28 -0700

On Jun 25, 2012, at 10:28 PM, Anders Rundgren wrote:

> credential enrollment standard for the *mass-market*.

If that is your intention, why do you refuse to back it up with any action? There is no way for the community to assess whether or not your idea is viable without seeing a concrete proposal for it.

> and didn't go anywhere. Protocol standardization is indeed a daunting task.

It is made more daunting by people who believe that they should "contribute" only by spewing ideas and not doing any real work. AFAICT, you are in that category; I would love to be proven wrong.

--Paul Hoffman

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 26 Jun 2012 17:42:21 +0200

On 2012-06-26 16:48, Paul Hoffman wrote:
> If that is your intention, why do you refuse to back it up with any action?
> There is no way for the community to assess whether or not your idea is viable
> without seeing a concrete proposal for it.

OK...  I have provided links to 70p+ of *very detailed* specifications
plus a number of "executive level" slide-shows as well.
I would estimate that the total effort including supporting code is about
3000 hours over a period of 5 calendar-years.

No, I didn't write an I-D because that would be pointless without first
having requirement discussions.  The latter died pretty immediately
when I mentioned End-2-End Security, Embedded Security Hardware, PIN-code
Deployment and Browser Interfaces.

Established PKI applications rely since years back on SCEP, CMP, and CMC
and doesn't seem to be in great need for a new standard.  This is the
reason why I suggested targeting *unestablished* but "promising" applications
like Mobile Payments, Virtual SIM-cards and Consumer-PKI in general.

I also find the mere idea of creating security applications [1] for people
who have no interest or knowledge about such, both challenging and fun :-)

Anyway, this is history, at least for PKIX.

Cheers,
Anders

1] I don't characterize SKS/KeyGen2 as a security application, but
as an IT-solution where security is a component among other.