Subject: Trust Anchor Management Protocol (TAMP)

From: "Anders Rundgren" <[email-masked]>
Date: Thu, 12 Jul 2007 20:57:48 +0200

NSA is reportedly developing a protocol for trust anchor management, possibly intended to become a PKIX WG item.

Reference: http://cryptome.org/poet-docs.htm item 44.

Although there seems to be no public data available, I believe that the concept of maintaining trust anchor stores through a protocol would if applied to networking, be similar to a protocol for maintaining "hosts" files rather than using DNS.  When trust anchor handling needs automation, a more universal approach is to off-load validation using a protocol like SCVP.  In fact, SCVP principles are already widely deployed for in-house systems where trust management is performed in one place.  Off-loaded validation also copes with EE-certificate revocation, policy filtering, and similar things that appear to be out of scope for a trust-anchor-focused system.

TAMP have one advantage of SCVP and that is that it may work in off-scenarios as well.  Given the fact that billions of people rely on on-line services, the off-line argument seems pretty week.

Just my 2 cents

Anders Rundgren

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 12 Jul 2007 15:10:19 -0700

At 8:57 PM +0200 7/12/07, Anders Rundgren wrote:
>NSA is reportedly developing a protocol for trust anchor management, 
>possibly intended to become a PKIX WG item.

No, it is meant to be a separate WG. It appears that you missed the 
announcement on this list a month ago. 
<http://www.imc.org/ietf-pkix/mail-archive/msg04747.html>.

>Although there seems to be no public data available

Except, of course, the mailing list for the BoF. 
<http://www.vpnc.org/ietf-trust-anchor/>

--Paul Hoffman, Director
--VPN Consortium

---

From: Thierry Moreau <[email-masked]>
Date: Fri, 13 Jul 2007 11:18:38 -0400

> Reference: http://cryptome.org/poet-docs.htm item 44.

E.g. see

http://www.ietf.org/internet-drafts/draft-wallace-ta-mgmt-problem-statement-01.txt

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]