Subject: Re: WG Last Call CLOSED: DPD/DPV Requirements

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 16 Jul 2002 12:11:58 +0200

Tim Polk wrote:

    "As there has been no discussion on the list regarding the DPD/DPV 
    requirements document I have forwarded it to Jeff and Steve.    We have 
    obsessed long enough, and there will be lots of opportunities to grind your 
    favorite axe on the protocol specs."

May I start swinging my "favorite axe", before people begin wrestling
another 24 months over this subject?

The market-leaders in the form of VeriSign (including esteemed
PKIX'er Phillip Hallam-Baker), Microsoft, IBM, as well as the
Open Source community have clearly shown that they are focusing
their efforts on XML-based schemes including PKI-based such.
XML-Dsig is really a huge success if you look at recent "design-ins".

And XKMS, which is already shipping, is AFAIK a "DP*"-solution.

IMO, it does not matter much if DPV/DPD will be "better" than
XKMS, as the market does not have this "granularity" in general.
That XKMS has a head start is considerably more important.

Note that this is not one of those dreary "XML is better than ASN.1"-
discussions, but a serious attempt to save energy, talent, time, and
money for other, hopefully more fruitful design-activities.

Naturally the IETF-PKIX chairs are free to ignore that the landscape
has changed since the DPD/DPV-effort was initiated, but I believe
that individual participants should not.

As similar situation occurred in 1995, when Microsoft pulled the plug
on their proprietary MSN-system the day before launch(!), when they
reluctantly realized that "The Internet has won".

That was in my opinion a very bold, and vigorous move that certainly
paid-off in the long-run.

Anders Rundgren

---

From: Stephen Kent <[email-masked]>
Date: Tue, 16 Jul 2002 19:42:35 -0400

Anders,

I'm sure we all appreciate your efforts to save the rest of us from 
wasting our time on DPV/DPD. Your message seems to indicate that you 
don't object to the rest of us continuing to work on this if we see 
fit.

Thanks,

Steve

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 17 Jul 2002 11:20:37 +0200

Thanx Steve,

Your phrase "the rest of us" indicates that I am the only PKIX'er who have
doubts regarding the validity of the DPD/DPV-effort.  I won't argue with that
as I have no proofs for the opposite, but rather base my view on information
gathered from other communities, drafts etc.   But please continue reading...

Long-term suggestion
------------------------
A problem with the e-mail-list approach including "rough consensus",
is that most people are rather timid, and do not particularly enjoy getting
publicly bashed.  Due to this fact, I believe it could be of some value to
add a voting-system to the IETF-mailing lists, where a list-member could
send a vote on a certain topic without being exposed on the list.  Then an
admittedly sensitive topic like "Should we continue the DPD/DPV effort",
could be voted on, and you would not only get a ratio of Yes and Noes,
but also a clear indication on how many who cares about a subject at all.
The suggested purpose of this would in no way be changing anything in the
IETF-process rules, but to gather additional input to critical decisions.

Short-term DPD/DPV-action
--------------------------------
Anyway, I believe it would be most appropriate and in everybody's
interest if the authors created a short rationale showing why the
DPV/DPD-effort should be continued in the light of recent advances
by competing efforts like XKMS.

Even in the security area there is a huge "cemetery" of technically
wonderful(?) standards-efforts that the market rejected, several
due to the existence of another system. PCT/SSL, S-HTTP/HTTPS,
and SPA/3D Secure belong to this latter category.

regards
Anders Rundgren

----- Original Message ----- 
From: "Stephen Kent" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, July 17, 2002 01:42
Subject: Re: WG Last Call CLOSED: DPD/DPV Requirements

Anders,

Thanks,

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 17 Jul 2002 05:04:03 -0400

>gathered from other communities, drafts etc.   But please continue reading...

Again, thanks for your suggestions on how to improve IETF processes. 
They will certainly receive due consideration.

Since we have at least 3, and maybe 4, proposals for protocols to 
satisfy the DPV/DPD requirements, I have complete confidence that 
there is a sufficient support for continuing the work in PKIX. If it 
were of no interest, we would have one proposed protocol, at best. As 
before, if you or others, feel that this is not a good use of your 
time, then you are free to ignore the activity.

Steve