Subject: Re: PKIs and trust

From: Neal McBurnett <[email-masked]>
Date: Mon, 15 Dec 2003 13:44:29 -0700

The term "PKI" is surely hyped and overloaded with meaning.  But as
many people are pointing out, the use of public key technology
supported by tools and infrastructures attuned to the needs of
user communities has its place, both now and in the future.

If you have great ideas in this area, or if you want to see vigorous
discussion and good research and development work, check out PKI04, as
well as the online proceedings of our previous workshops.
Papers due by Jan 30, workshop at NIST April 12-14....

Neal McBurnett                 http://bcn.boulder.co.us/~neal/
Signed and/or sealed mail encouraged.  GPG/PGP Keyid: 2C9EBA60

        3rd Annual PKI R&D Workshop - Call for Papers
           http://middleware.internet2.edu/pki04/

Jointly sponsored by NIH, NIST, and Internet2, in cooperation with
USENIX and OASIS.

This workshop considers the full range of public key technology used
for security decisions. PKI supports a variety of functionalities
including authentication, authorization, identity (syndication,
federation and aggregation) and trust.

We solicit papers, scenarios, war stories, panel proposals, and
participation from researchers, systems architects, vendor engineers
and above all users.

Location:                 NIST, Gaithersburg MD, USA.
Papers and Proposals due: January 30, 2004
Authors Notified:         March 1, 2004
Final Materials Due:      March 22, 2004
Workshop Dates:           April 12-14, 2004

This workshop has three goals:

  * Explore the current state of public key technology in different
    domains including web services, grid technologies, authentication
    systems et. al. in academia & research, government and industry.
  * Share & discuss lessons learned and scenarios from vendors and
    practitioners on current deployments
  * Provide a forum for leading security researchers to explore the
    issues relevant to the PKI space in areas of security management,
    identity, trust, policy, authentication and authorization.

The results will be promulgated in several ways, including:
  * a published proceedings with refereed papers and summaries of
    workshop discussions
  * the workshop web site: http://middleware.internet2.edu/pki04/
  * experimental initiatives within higher education

Outstanding papers will be invited for possible publication in ACM
TISSEC.

Presentation formats will include:
  * Refereed papers
  * Panel discussions
  * Invited talks
  * Work-in-progress updates

Submitted works for panels, papers and reports should address one or
more critical areas of inquiry. Topics include (but not are not
limited to):
  * PKI systems in various domains like grid, web services,
    government, industry and academia.
  * PKI and Federated trust
  * Related standards: x509, SDSI/SPKI, PGP, XKMS, SAML, Shibboleth,
    Liberty Alliance, etc.
  * Cryptographic methods in support of security decisions
  * The characterization and encoding of security decision data
  * Security protocols and choreographies - new ideas, analysis of
    existing systems et al
  * Alternative methods for supporting security decisions
  * Intersection of Policy based systems and PKI
  * Privacy protection and implications of different approaches
  * Scalability of security systems - are there limits to growth?
  * Security of the various components of a system: private keys, root
    authorities, certificate storage, communications channels, code,
    directories, etc.
  * Mobility solutions
  * Approaches to attributes and delegation
  * Improved designs for security-related user interfaces
  * Human factors issues with naming, multiple private keys, selective
    disclosure
  * Discussion of how the "public key infrastructure" may differ from
    the "PKI" traditionally defined
  * Reports of real-world experience with the use and deployment of
    PKI, especially where future research directions for PKI are
    indicated
  * What is missing? The gaps in PKI research and standards from a
    systems engineering point-of-view

Submissions and Additional Information

Papers should be submitted electronically, in PDF, formatted for
standard US letter-size paper (8.5 x 11 inches). The final version of
refereed papers should ideally be between 8 and 15 pages, and in no
case more than 20 pages. They should have no header or footer text
(e.g., no page numbers).

Proposals for panels should be no longer than five pages in length and
should include possible panelists and an indication of which of those
panelists have confirmed participation.

Please submit the following information by email to
[email-masked]:
  * The full contact details (name, affiliation, email, phone, postal
    address) of one author who will act as the primary contact for
    this paper.
  * The full list of authors: you must supply the first name, the last
    name and the affiliation of each author.
  * The finished paper in PDF format as an attachment.

All submissions will be acknowledged.

The deadline for submission is January 30, 2004. Requests for short
extensions will be granted on a case-by-case basis, and must be
requested by January 30th via email to the same address.

When appropriate, authors should arrange for a release for publication
from their employer prior to submission. Papers accompanied by
non-disclosure agreement forms are not acceptable and will be returned
to the author(s) unread.

Submissions of papers must not substantially duplicate work that any
of the authors have published elsewhere or have submitted in parallel
to any other conferences or journals.

The registration fee will be waived for presenters. A limited number
of stipends are available to those unable to obtain funding to attend
the workshop. Further information will be available on the
registration page in January.

Program Committee

   Peter Alterman       NIH
   Matt Blaze           AT&T Labs Research
   Bill Burr            NIST
   Yassir Elley         Sun Microsystems
   Carl Ellison         Microsoft
   Stephen Farrell      Trinity College Dublin, 
   Richard Guida        Johnson & Johnson
   Peter Honeyman       University of Michigan
   Russ Housley         Vigil Security LLC
   Ken Klingenstein     University of Colorado
   Olga Kornievskaia    University of Michigan
   Neal McBurnett       Internet2
   Clifford Neuman      USC
   Eric Norman          University of Wisconsin
   Tim Polk             NIST
   Ravi Sandhu          George Mason University; NSD Security
   Krishna Sankar       Cisco Systems
   Jeff Schiller        MIT
   Frank Siebenlist     Argonne National Laboratory
   Sean Smith           Dartmouth College
   Michael Wiener       Cryptographic Clarity

General Chair: 
   Ken Klingenstein, University of Colorado.

Program Chair:
   Krishna Sankar, Cisco Systems.

Steering Committee Chair:
   Neal McBurnett, Internet2.

Local Arrangements Chair:
   Nelson Hastings, NIST.

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 16 Dec 2003 06:17:26 +0900

Neal McBurnett;

> The term "PKI" is surely hyped and overloaded with meaning.

Can you clarify *YOUR* definition of PKI?

> But as

"tools AND infrastructures"?

I have been having a feeling that people who claims to be working
on PKI call tools to support public key technology PKI. But, you,
apparently, are not.

							Masataka Ohta

---

From: Neal McBurnett <[email-masked]>
Date: Mon, 15 Dec 2003 19:49:57 -0700

On Tue, Dec 16, 2003 at 06:17:26AM +0900, Masataka Ohta wrote:
> Neal McBurnett wrote:

At our PKI workshops there have always been people from a wide variety
of perspectives.  PKI is a buzzword which we use in lieu of something
more widely accepted as pertaining to the full range of public key
technologies, infrastructures, tools, objects, policies, policy
languages, etc. used for security decisions.

> on PKI call tools to support public key technology PKI. But, you,

If someone tried to sell me tools and seriously claimed it was a
"PKI", I'd know they didn't understand what an infrastructure is.
But arguing about terminology rapidly leads to a black hole.
As has been seen recently in the case of DNS, the potential for
confusion often pops up when tools and infrastructure and policy
are mixed together in what we call middleware (to introduce another
buzzword - sigh).

To bring this closer to specifics and thus the engineering realm, one
area currently bearing fruit is federations: communities who can agree
on policies, data formats, tools, and definitions of other key issues
(heh - sic :-).

See FOO - Federating Organizations Organization
 http://middleware.internet2.edu/foo/

Federations (like InCommon) need tools (like shibboleth):
 http://incommon.internet2.edu/
 http://shibboleth.internet2.edu/

The public key aspects are mostly below the surface.

This is all related to the Middleware Architecture Committee for
Education (MACE) work in directories, object classes, policy
languages, etc.

---

From: jfcm <[email-masked]>
Date: Tue, 16 Dec 2003 13:13:04 +0100

>are mixed together in what we call middleware (to introduce another

What is needed is a modelization. As in many other places.
And a lexical to use the words in the same way.

>on policies, data formats, tools, and definitions of other key issues

Why to object that to Gov sponsored communities as well? The
users best favored one will win. May be a social community in
some places, a business service in others, a Law defined standard
in some other places or for some usages.

Why do you want to decide for others?
jfc