Subject: RE: Scope of PKIXML-WG. Was: Should PKIX protocols support XML w ell?

From: Michael Zolotarev <[email-masked]>
Date: Wed, 22 Nov 2000 14:52:51 +1100

All,

Before I start, I'd like to make my position clear:  I accept the fact of
XML been popular. But I don't accept the fact that XML is superior for the
areas where ASN is currently used. So far, my two cents worth of the
discussion was entirely devoted to the attempts to see whether XML presents
a better choice *technically*. And so far, I'm still standing firm on my
original position. But let's forget about it for a moment.

****************************
<<Don't interpret what I'm about to say as a manifest of my personal, or
Baltimore's, support of it. It is just a position that I suggest might be
*considered* by the list, as an attempt to sort out the current 'crisis'
situation>>
****************************

I beleive that we have to come up with a solution too. Or at least to
outline how we can proceed to reach a solution before, or during the next
IETF meeting. 
I would certainly hope that IETF is the right place to handle *this*. But
first we have to decide what exactly *this* is.

1. Transition to XML everywhere where currently ASN1 is used? 
2. XML as an ASN1 replacement for *anything* new which has a PKI smell in
it? 
3. XML as one of the languages of authorisation (and *probably*
authentication) frameworks?

(1): I don't think so. And we have already discussed and passed that point,
I hope.
(2): What such a WG would be concerned about? Defining
"XML-for-PKI-in-general, except 'core' PKI constructs"? Or concentrating on
every particular existing and future protocols, and explaining "in general"
how XML can be used there? Frankly, I don't think we'll get anywhere going
this way.
(3): We may develop a practical approach for a particular area. The approach
(and the mistakes we'll made on the way) can be utilised by the others in
the future, should other hi-level protocols decide to use XML too. Stop
mixing up with OCSPv2 /SCVP issues (they have to decide on the concept and
the use models first, before talking the actual encoding).

Let me elaborate on the (3):
WHAT: Activity. Not a WG.
WHERE: IETF AAA WG. I just think it'd be a right place for it. Outside of
PKIX, which maintains its purity and concentrates on core protocols and
structures. Not in W3C, which shouldn't be dealing with anything higher than
core XML (language, schemas, basic XML signing etc).
HOW: I can see two possible approaches here:
	a) by doing it from scratch
	b) by accommodating the work currently being done by vendor
consortiums.

Both (a) and (b) have cons and pros:
Doing it from scratch will be not so productive, considering that there is
something already been done. And the activity may be facing a huge
opposition by the vendors (which is happening already, mind you - didnt get
much traffic on the list from Netegrity and Co).

Letting the vendors to do the 'dirty work' first, and then 'donate' the
results to the IETF to finish the polishing up is probably the way to go.
Depends on their willingless to cooperate. We saw it happening in the past -
SSL/TLS is an example of a vendor-initiated standard. However, the earlier
IETF gets involved, the better.

What do we do now:

Agree on wheter we are talking (1), (2) or (3).

If we manage to agree that (3) is a viable option, I suggest we investigate
(a) and (b) immediately. By talking to all involved parties, the S2ML,
probably DirectoryForum, and try to do as much background work before San
Diego.

Opinions?

Michael

PS Good morning to everybody. I'm prepared to stay at work late tonight.

> -----Original Message-----
> From: Anders Rundgren [mailto:[email-masked]]
> Sent: Tuesday, 21 November 2000 17:19
> To: Michael Zolotarev; Stephen Kent; Nada Kapidzic Cicovic
> Cc: PKIX-List
> Subject: Re: Scope of PKIXML-WG. Was: Should PKIX protocols 
> support XML
> well?
> 
> 
> Michael,
> 
> Instead of fighting an impossible battle (which is best 
> of...) we must handle this NOW.
> 
> The following list which I got from Peter Lipp of IAIK shows 
> what the options are:
> 
> - that this was a stupid idea from the beginning and 
> everybody involved
>   should be ashamed
> - to have it as an activity which would be ideally placed within the
>   PKIX-group (which is not really an option as Steven Kent and many
>   others would not support it)
> - to have it as a new activity of the XML-DSig WG
> - to start a new WG within the IETF
> - to start a new WG within W3C
> - to start a new joint WG within W3C/IETF
> 
> My definition of scope is "PKI with XML-flavor" i still valid
> 
> > That's exactly what I'm afraid of - spending efforts and 
> resources on
> > something which is purely market reasons-driven. There must 
> be [at least a
> > fraction of] technical rationale behind it, not just an 
> 'executive level
> > ability to comprehend'. And yes, of course I know that a 
> lot of people don't
> > agree with it.
> 
> If technical rationale has to involve superiority over ASN.1 
> in _every_ technical respect
> it is a lost case.  I consider the OID vs Schema to be a 
> techical reason to switch to
> XML. You don't agree that this is valid.  But that XML 
> parsers will be a part of the OS is
> a hard fact to consider.
> 
> XMLDSIG i AFAIK a replacement for PKCS #7 and why did the 
> IETF bother with that?  
> So far as I can see even Baltimore is pushing (proprietary) XML-based
> security solutions.
> 
> That XML is becoming the "lingua franqua" in just about all 
> sectors makes
> it a bit more interesting than a pure execetive level thing.  
> And If XML works
> in e-commerce, banking, etc. it simply must work in PKI as 
> well.  I think that XMLDSIG
> actually proves everything we need to know at this stage.
> 
> Anders
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 22 Nov 2000 09:51:58 +0100

Michael,

> first we have to decide what exactly *this* is.

I have been encouraged to submit a BOF on this.  Unfortunately none of the area
managers have responded to my request for action.  To "settle" the scope
should IMO not be done by those who do not intend to participate.

                    ___MEMBERZ RULEZ!___

> WHAT: Activity. Not a WG.

Why not?

> WHERE: IETF AAA WG. I just think it'd be a right place for it.

I can't find any descriptions of the AAA WG. 

> Outside of PKIX, which maintains its purity and concentrates on core protocols and
> structures.

PKIXML would not nessesary be unpure.  Some PKIX's members are undoubtly purists.

>Not in W3C, which shouldn't be dealing with anything higher than

Here I may actually agree :-)

> b) by accommodating the work currently being done by vendor

a) Doing _what_ from scratch?
b) It can in some cases be done.  But rather seldom as the consortiums usually
are commercial and don't want interference.  S2ML, OBI, WAP, IDENTRUS, SetCo etc. all
belong to this category. From en engineer's point of view I find it very uninspiring to to spend
a lot of energy on nit-picking instead of being there when the ground is made.  The discussions
regarding ACs is an example of working in total darkness as the questions really are: Does this work?
Will it get generally (=MSFT) be supported?

AFAIK we have several possible work items for PKIXML
- AC's 
- Path validation protocols (I am not fully updated on these)

Anders