Subject: RE: I-D Action:draft-ietf-pkix-ta-mgmt-problem-statement-00.txt

From: Carl Wallace <[email-masked]>
Date: Thu, 20 Dec 2007 11:09:22 -0500

This draft is mostly the same as the -02 draft that had been submitted for
the TAM BOF.  A revised draft will be submitted next month to address
comments collected from the various TAM straw poll threads over the past few
weeks or any comments relative to this draft between now and then.

Carl

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: Thursday, December 20, 2007 10:20 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: I-D Action:draft-ietf-pkix-ta-mgmt-problem-statement-00.txt 
> 
> A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
> This draft is a work item of the Public-Key Infrastructure 
> (X.509) Working Group of the IETF.
> 
> 
> 	Title           : Trust Anchor Management Problem Statement
> 	Author(s)       : R. Reddy, C. Wallace
> 	Filename        : 
> draft-ietf-pkix-ta-mgmt-problem-statement-00.txt
> 	Pages           : 14
> 	Date            : 2007-12-20
> 
> A trust anchor represents an authoritative entity via a 
> public key and associated data.  The public key is used to 
> verify digital signatures and the associated data is used to 
> constrain the types of information for which the trust anchor 
> is authoritative.  Relying parties use trust anchors to 
> determine if digitally signed objects are valid by verifying 
> digital signatures using the trust anchor's public key and by 
> enforcing the constraints expressed in the associated data.  
> This document describes some of the problems associated with 
> the lack of a standard trust anchor management mechanism as 
> well as problems that must be addressed by such a mechanism.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-pkix-ta-mgmt-pr
oblem-statement-00.txt
> 
> To remove yourself from the I-D Announcement list, send a 
> message to [email-masked] with the word 
> unsubscribe in the body of the message.
> You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
> to change your subscription settings.
> 
> Internet-Drafts are also available by anonymous FTP. Login 
> with the username "anonymous" and a password of your e-mail 
> address. After logging in, type "cd internet-drafts" and then
> 	"get draft-ietf-pkix-ta-mgmt-problem-statement-00.txt".
> 
> A list of Internet-Drafts directories can be found in 
> http://www.ietf.org/shadow.html or 
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> Internet-Drafts can also be obtained by e-mail.
> 
> Send a message to:
> 	[email-masked].
> In the body type:
> 	"FILE 
> /internet-drafts/draft-ietf-pkix-ta-mgmt-problem-statement-00.txt".
> 
> NOTE:   The mail server at ietf.org can return the document in
> 	MIME-encoded form by using the "mpack" utility.  To use this
> 	feature, insert the command "ENCODING mime" before the "FILE"
> 	command.  To decode the response(s), you will need "munpack" or
> 	a MIME-compliant mail reader.  Different MIME-compliant 
> mail readers
> 	exhibit different behavior, especially when dealing with
> 	"multipart" MIME messages (i.e. documents which have been split
> 	up into multiple messages), so check your local documentation on
> 	how to manipulate these messages.
> 
> Below is the data which will enable a MIME compliant mail 
> reader implementation to automatically retrieve the ASCII 
> version of the Internet-Draft.
>

---

From: "Kemp, David P." <[email-masked]>
Date: Thu, 20 Dec 2007 16:39:11 -0500

Carl,

One of the questions I would like to see asked is whether there is a
requirement for symmetric key trust anchors.  Although the draft problem
statement says "A trust anchor represents an authoritative entity via a
public key and associated data", there is no reason that an
authoritative entity could not be represented by a symmetric key and
associated data.  The purpose of the public key TA is to authenticate
messages from the authoritative entity, and a symmetric TA with MAC
could be used for the same purpose.  Many devices today are provisioned
with symmetric authority keys (admin passwords, community strings, smart
card manufacturer keys, etc), and it may (or may not - that's the
purpose of discussion) facilitate transition to standardize a mechanism
to permit devices provisioned with only a symmetric key to authenticate
TAM message content.

Even if there is consensus not to consider symmetric TAs, it would be
more accurate to say "A trust anchor represents an authoritative entity
via a cryptographic key and associated data.  This document discusses
only public keys as trust anchors; symmetric key trust anchors are not
considered."

Dave

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Carl Wallace
Sent: Thursday, December 20, 2007 11:09 AM
To: [email-masked]
Subject: RE: I-D Action:draft-ietf-pkix-ta-mgmt-problem-statement-00.txt

This draft is mostly the same as the -02 draft that had been submitted
for the TAM BOF.  A revised draft will be submitted next month to
address comments collected from the various TAM straw poll threads over
the past few weeks or any comments relative to this draft between now
and then.

Carl 

> is authoritative.