Subject: RE: Scope of PKIXML-WG. Was: Should PKIX protocols support XML w ell?

From: Michael Zolotarev <[email-masked]>
Date: Tue, 21 Nov 2000 11:36:10 +1100

> 
> For a company like yours (Entegrity), it could be important 
> to actually jump on the
> XML PKI bandwagon if only for marketing reasons. I guess you 
> saw that Warwick
> Ford of VeriSign supported a variant of XML ACs (S2ML).  
> 

That's exactly what I'm afraid of - spending efforts and resources on
something which is purely market reasons-driven. There must be [at least a
fraction of] technical rationale behind it, not just an 'executive level
ability to comprehend'. And yes, of course I know that a lot of people don't
agree with it.

On a side note: within boundaries of what meant to be a vendor-neutral
technical discussion, it is just not very ..ehm... right, to rush people
into something by saying "if you don't, your competitors will". Nobody has
ever proven that XML authorisation will be [more] successful than ASN. The
fact that some vendors have got together for something does not necessarily
mean a red alert for the rest of the vendors. Something to keep an eye on -
sure.

We all can read in between the lines - you don't have to be that specific,
Anders :).

Regards
M

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 21 Nov 2000 08:18:39 +0100

Michael,

Instead of fighting an impossible battle (which is best of...) we must handle this NOW.

The following list which I got from Peter Lipp of IAIK shows what the options are:

- that this was a stupid idea from the beginning and everybody involved
  should be ashamed
- to have it as an activity which would be ideally placed within the
  PKIX-group (which is not really an option as Steven Kent and many
  others would not support it)
- to have it as a new activity of the XML-DSig WG
- to start a new WG within the IETF
- to start a new WG within W3C
- to start a new joint WG within W3C/IETF

My definition of scope is "PKI with XML-flavor" i still valid

> ability to comprehend'. And yes, of course I know that a lot of people don't

If technical rationale has to involve superiority over ASN.1 in _every_ technical respect
it is a lost case.  I consider the OID vs Schema to be a techical reason to switch to
XML. You don't agree that this is valid.  But that XML parsers will be a part of the OS is
a hard fact to consider.

XMLDSIG i AFAIK a replacement for PKCS #7 and why did the IETF bother with that?  
So far as I can see even Baltimore is pushing (proprietary) XML-based
security solutions.

That XML is becoming the "lingua franqua" in just about all sectors makes
it a bit more interesting than a pure execetive level thing.  And If XML works
in e-commerce, banking, etc. it simply must work in PKI as well.  I think that XMLDSIG
actually proves everything we need to know at this stage.

Anders

---

From: Eric Rescorla <[email-masked]>
Date: 20 Nov 2000 23:37:45 -0800

"Anders Rundgren" <[email-masked]> writes:
> XMLDSIG i AFAIK a replacement for PKCS #7 and why did the IETF
> bother with that?  So far as I can see even Baltimore is pushing
> (proprietary) XML-based security solutions.
XMLDSIG is certainly not a replacement for PKCS-7. How could it 
be, since it does not provide for encryption?

-Ekr

---

From: "Peter Lipp" <[email-masked]>
Date: Tue, 21 Nov 2000 09:05:43 +0100

Eric,

>be, since it does not provide for encryption?
Ok, let it be half a replacement and the other half currently being worked
on in the XML-encryption-(list,WG?) - so what's the point...

Peter

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 21 Nov 2000 16:51:53 +0100

> be, since it does not provide for encryption?

OK, I erred. XMLDSIG only replaces a _subset_ of PKCS #7.  But it is definitely an example
of "PKI with XML-flavor"

It would be of more interest to know your opinion on PKIXML, or should I interprete
your geekic comment as: PKI+XML is crap, so why bother?

Anders

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 21 Nov 2000 17:26:34 +0100

Ladies and Gentlemen,

I think it would be improper to gather people from all over the globe without
putting the above subject on the aggenda. 

I.e. those who _are_ interested must know which day this is going to be
discussed.  There should be at least 2 hours of meeting time.

Or at least setup a PKIXML mailing-list.

Looking forward to a quick handling.

Best regards

Anders Rundgren
co-founder X-OBI
+46  70 - 627 74 37

---

From: "Jeff Davis" <[email-masked]>
Date: Tue, 21 Nov 2000 16:51:10 -0000

Anders,

From a potential user of the PKIX standards and a developer of software
products we are currently using XML within our product suites for
describing data and sending between various points etc.  In about 6 to 8
months we will be wanting to create PKCS#10 requests and receive PKCS#7
responses etc in other product ventures (probably will also use many of
the other PKCS#'s as well ).

One of the skill bases we have is JAVA and XML.  It would make sense to
me to be able to do PKIXML in the future period and not have to either
re-skill my development workforce/get new skill set in in order to
process ASN-1/BER etc. (a selfish attitude maybe but when I asked them
if anyone had knowledge of ASN-1, all I got was blank faces, it is a sad
world! )  - tell me if I am missing something here that my JAVA
programmers do not need to know the finer arts of ASN-1 to actual
interface to it!.

So, I for one would like to see a WG go forward so the PKIX does support
XML. This would give people a choice in the future if it does transpire
that XML can do the job, and as secure as present methods.

Hope this does not conflict too much with the purists for PKIX standards
as they have done/doing a great job.  I just think that you now need to
at least give XML a good hearing and this may be best served inside a
WG.

Jeff Davis
SafeStone Technologies
( beginner in PKI )

----- Original Message -----
From: Anders Rundgren <[email-masked]>
To: EKR <[email-masked]>
Cc: PKIX-List <[email-masked]>
Sent: Tuesday, November 21, 2000 3:51 PM
Subject: Re: Scope of PKIXML-WG. Was: Should PKIX protocols support XML
well?

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Tue, 21 Nov 2000 19:07:31 +0100

> programmers do not need to know the finer arts of ASN-1 to actual

Your JAVA programmer do not need to know the finer arts of ASN-1 to actual
interface to it.

Did you redevelop an XML interpreter from scratch in your software product ?

I don't believe so.

You just need a Java library that can be used to read the PKIX structures
and then interpret the content of the object, but not to understand the
finer details of ASN.1/DER.

I believe you will find this such a java toolkit in the Jonah library that's
available for free, but unfortunately doesn't seem to be as of now fully
available for export outside of america.

Probably other people here can give you the name of other products than can
be used for that.

This doesn't mean your programmer will not have to learn a lot of new
things.

They will have to understand what the content of this objects is, how they
behaves, concepts of PKI infrastructures.
But this is not because the transport layer uses ASN.1/DER.
It's because it will be a new environment for them, and it would be the same
if we reimplement everything in XML.

This said it might be that the PKIX environement lacks reasonnally priced,
properly documented !!! development environments.

I know several that are available for free, but which one has a
documentation that can compare to the one of any XML toolkit ?
Except for a commercial product that doesn't comply to the "reasonnally
priced" criterium.

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 21 Nov 2000 20:48:55 +0100

Eric,

> I took it to be that XMLDSIG was evidence that the IETF intended
> to cook up a parallel cryptographic infrastructure based on XML. 
> We may decide to do that now, but I think it's pretty clear that
> XMLDSIG was not intended as part of such an effort. If it had
> been, encryption would have been part of it, since encryption
> and DSIG are so clearly of a single piece: messaging.

I think that a major reason why XMLDSIG didn't "do it all"  is that encryption has a
much, much lower priority for the sector that actually _screems_ for better
solutions.  E-business and banking.

Such apps use TLS/SSL in 99.9% of all cases, and encrypted data would just
complicate things.

Anyway, IETF's involvement in XMLDSIG was pretty late and probably included
some "politics" as well so it may not be entirely valid of what the future will bring.

Nevertheless, XMLDSIG will probably be one of the most significant PKI-related
standards ever.  Not far from the importance of PKCs and SSL.

Going back to the original question: Do you support the forming of a new PKIXML WG?

Anders

---

From: EKR <[email-masked]>
Date: Fri, 24 Nov 2000 21:42:51 -0800

> some "politics" as well so it may not be entirely valid of what the future will bring.
This doesn't accord with my memory. I remember the IETF getting involved
quite early. Certainly, IETFers contributed substantially to the document.
Certainly, there was politics involved.

> Going back to the original question: Do you support the forming of a
Yes. 

-Ekr