Subject: RE: I-D ACTION:draft-ietf-pkix-certstore-http-01.txt

From: [email-masked] (Peter Gutmann)
Date: Wed, 9 Jan 2002 17:20:29 +1300 (NZDT)

"Piers Chivers" <[email-masked]> writes:

>This may be off-topic but have you considered a SOAP version of this protocol.
>SOAP messages can be transported over http, hence meeting this requirement,
>but can also be transported over SMTP etc.  This seems to me to be a more
>general approach than the one described here.

I've had comments from people about XML versions ages ago (the certs-over-http
stuff has been in use privately for awhile, which is why some of the stuff in
the draft is based on implementation experience), but I'll leave that to
someone else.  I just wanted to create a lowest-common-denominator gimme-a-cert
mechanism which is as plug-and-play as possible, if anyone wants something more
complex they can profile it or whatever.

(I'm also not too sure what SOAP would add, apart from making it a lot less
 general).

>email       "Email address contained in the certificate..." What does this
>mean? I think you should be more explicit. Will the search be against an email
>attribute in the subject DN, or an attribute in the subject alternative name...

It doesn't matter.  An email address is an email address, they can stuff it in
the keyUsage for all I care.

>"The one exception to this process is the subjectKeyIdentifier..." I hate
>exceptions to rules;)  Why bother with this proviso?  OK, it stops one
>needless hash but it introduces additional coding at both the client and
>server.  Why not just hash the hash?

Actually where it's being used at the moment the hash is hashed, mostly because
sKIDs can have arbitrary lengths and you need a way to make them uniform.  I
didn't do the hash-of-hash because I thought there'd be complaints, but I agree
with you that it's a better way to do it.  I'll fix it in the next draft.

>Although earlier text indicates why, the examples for retrieving a CA cert and
>a CRL are identical in this section.  I think this should be clarified (by
>indicating a query URI appropriately)

Done.

Peter.

---

From: Rich Salz <[email-masked]>
Date: Wed, 09 Jan 2002 07:59:18 -0500

> >This may be off-topic but have you considered a SOAP version of this protocol.

Check out XKMS, a W3C Note and new standards Activity.  It addresses
similar problems (and then some), in a purely XML environment.  Better
to use XKMS than to let the XML nose under the PKIX tent. :)
	/r$
-- 
Zolera Systems, Securing web services (XML, SOAP, Signatures,
Encryption)
http://www.zolera.com