Subject: Re: PKI Resources Query Protocol

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 1 Jul 2005 09:29:22 +0200

Massimiliano,

>I am working on the definition of a new protocol aimed to solve the problem
>tied to the lack of informations about repositories and services offered
>by a CSP.

OK. Does that also include warranties?

>One of the problems we are facing now is how to connect different
>closed existing PKIs.

What do you mean with "connect"?  I thought that NIST and other US
government bodies already consider this solved by using bridge CAs.
(personally I believe bridges will rarely reach outside of the public
sector border as neither the implicit trust model, nor the bridge CA 
business model are particularly suited for the commercial world)

>For this purpose I think that the availability of URI about offered services
>(e.g. OCSP, SCVP, etc... ) or available data (e.g. certificate and CRLs
>repositories) would help in PKI interoperability.

How do you find the URI?  In a certificate extension or OOB?

>Therefore I am trying to work on this subject by defining a newprotocol.
>Reasons to adopt such a protocol are:
>- extensions are too static, if new services or repositories are added
>   (or dismissed) by the CSP, there is no sign of the changes into the
>   already issued certificates
>- no need to define new type of extensions for new services and/or
>   repositories as this will be handled by the PRQP (PKI Resources Query
>   Protocol)
>- (practical consideration) in my experience it is easier to deal with a
>   protocol than with certificate extensions (from a management and implementation
>   point of view)

Sounds good.

>The protocol I am thinking about is a very lightweight (much like OCSP)
>one and it is based on a request/response mechanism over HTTP.

Here I am not entirely in agreement.  I doubt that you need to query these
things frequently and then a Web Services interface would be more extensible.
I.e. the URI would point to WSDL rather than to the service itself.

>Said this, I would really like to have your opinion on this approach, and to
>know if someone is already working on a similar idea. In that case we could
>collaborate on the subject and come up with a proposal for an RFC.
>When I'll have something readable I will send it to the list (I know the PKIX
>is going to be closed, but until that day I guess this is the best place
>for this discussion... if not, just let me know).

If you go for Web Services, maybe OASIS would be a better place?

thanks
Anders Rundgren

-- 

Best Regards,

Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]      [email-masked]
                                                 Tel.:   +39 (0)11  564 7081
http://security.polito.it                       Fax:    +39   178  270 2077
                                                 Mobile: +39 (0)347 7222 365

Politecnico di Torino (EuroPKI)
Certification Authority Informations:

Authority Access Point                                  http://ca.polito.it
Authority's Certificate:          http://ca.polito.it/ca_cert/en_index.html
Certificate Revocation List:              http://ca.polito.it/crl02/crl.crl
--o------------------------------------------------------------------------