Subject: [KEYPROV] info on P1619.3

From: "Griffin, Robert" <[email-masked]>
Date: Tue, 12 Jun 2007 12:37:39 -0400

Hi -

As promised in the last IETF KEYPROV meeting, here are pointers to
several sources of info about the P1619.3 key management standards
project:

-          The approved Project Authorization Request
(http://standards.ieee.org/board/nes/projects/1619-3.pdf) defines the
scope, purpose and need for the standard:

5.2 Scope: This standard specifies an architecture for the key
management infrastructure for cryptographic protection of stored data,
describing interfaces, methods and algorithms.

5.4 Purpose: This standard defines methods for the storage, management,
and distribution of cryptographic keys used for the protection of stored
data. This standard augments existing

key management methodologies to address issues specific to cryptographic
protection of stored data. This includes stored data protected by
compliant implementations of other

standards in the IEEE 1619 family.

5.5 Need for the Project: There is a need for a simple key management
standard that manages the keys use within P1619.x-compliant hard disks
and tape drives. This standard intends

to fulfill this need.

-          Minutes from committee meetings are available at
http://ieee-p1619.wetpaint.com/page/P1619.3+2007-05-07

-          The latest draft of the spec is available from the P1619.3
home page at
http://ieee-p1619.wetpaint.com/page/Key+Management+Subcommittee+PAR+Work
sheet

-          Home page for the IEEE Security in Storage Working Group,
which sponsors P1619.3, is at http://ieee-p1619.wetpaint.com/?t=anon

Regards,

Bob

Bob Griffin

Technical Marketing Director

Data Security Division

RSA, the Security Division of EMC

* 781-515-6226

* 603-325-5103 mobile

781-515-5320 fax

_______________________________________________
KEYPROV mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/keyprov

---

From: "Rundgren, Anders" <[email-masked]>
Date: Thu, 14 Jun 2007 09:23:39 +0100

Dear all,

Although only being an occasional lurker on this list, may I comment
on the tentative specifications anyway?
 
The three (PKI) key provisioning mechanisms mentioned in the subject
line are quite different from each other but have one thing in common
and that is that they are primarily used in conjunction with browser-
based processes.

Note that although browsers indeed use HTTP, "HTTP-bindings" are not
equivalent to "browser-bindings" because the latter require links
to the browser platform which may constitute of Javascript objects,
dedicated MIME-types, or specific HTML tags.

Among benefits of using browser-based key provisioning processes
I would include:

- Elimination of user/session authentication elements in the protocol
  itself by reusing existing web technology

- Efficient provisioning processes where invocation URLs can be sent
  through e-mail and SMS and then clicked on by the user

- High flexibility regarding the orchestration of the provisioning
  process

KEYPROV seems to depart from this fairly established paradigm.
 
Is there a rationale for taking this direction, apart from the
obvious hurdle of getting browser vendors interested?

Anders Rundgren