Subject: Re: [pkix] Gathering Consensus for progressing PKI standards (?)

From: Martin Hecht <[email-masked]>
Date: Tue, 26 Aug 2014 14:55:35 +0200

Hi all,

let me pick up the OCSP topic: especially with Heardbleed in mind there
is a strong need for a working and scalable revocation mechanism. OCSP
over DNS sounds interesting to me, but also working out a more compact
OCSP-like protocol, which may scale better for large revocation lists.
Such ideas which could one day replace the pki infrastructure as it is
implemented nowadays need to be discussed in some sort of a forum, which
would take care of improving the concepts and working out a proposal for
such new standards. Even if browsers implement those mechanisms with a
considerable delay, first working out the standards, then establishing a
working pki infrastructure which supports such new mechanisms would be
the way to go. Finally, the client software like browsers or embedded
devices would follow.

best regards,
Martin

__________________________________________________________________

* From: Massimiliano Pala <[email-masked]>
* To: [email-masked]
* Date: Thu, 24 Jul 2014 13:45:58 -0400
* List-id: PKIX Working Group <pkix.ietf.org>
__________________________________________________________________

Hi PKIX-ers,
I would like to have your opinion about a new proposal for resuming some
work about PKIX. I am working on some interesting items that I think
they might be useful to work on in the PKI (not only for just browser's
authentication) area and I was wondering if anybody would be interested
in re-open the PKIX WG and/or start a new WG where this work can be
accomplished. (I know many people when they hear about re-opening work
in the PKIX WG probably will have goose bumps, but I really feel there
is the need to
progress in this area) In particular I would like to gather your opinion
on the following items that I think it would be very important to work on:
* Dissemination of Revocation information via DNS (i.e., OCSP over DNS)
- improving the availability of OCSP responses and reducing operational
costs for supporting revocation for high-volume websites.
* Implementation of a more compact OCSP-like response format (different
format from OCSP that might provide the same level of security, but more
compact responses and lower network impact) for online authentication
* PKI Service Discovery - in other words, how to find services related
to a certificate (following up on the PRQP draft)
* Provisioning of PKI services via 0-configuration protocols that would
allow current standards (e.g., CMS, CMC, etc.) to be routed
over self-organizing networks (e.g., P2P)
* Integrating new advancements in crypto (ECC) into PKIX
For all these topics, I have a hard time identifying the right WG where
the right expertise can be found and discussions / standardizations can
happen. If there is no consensus on resuming a pkix or pkix-like WG. It
also seems that there are some requests from the SEC area meeting
suggesting that some discussions about PKIX could be a good thing. To
limit the lifetime of this WG, this work could be split into smaller WGs
with very limited scope (e.g., PKIXREV, PKIXECC, PKIX2P) for the
different projects (revocation, crypto, p2p, etc.) instead of having a
PKIX-like one that would have a more extended charter. I hope this
e-mail will spawn some interesting discussion and possibly a path to
move forward.
Cheers,
Max

---

From: Juan Gonzalez <[email-masked]>
Date: Tue, 26 Aug 2014 18:30:49 -0500

Martin:

Although I've been implementing crypto standards (ITU-T / RFC / ETSI) since
1996,
I have never participated in the definition of an RFC. I offer to help you
in this one.

Best Regards
Juan González Cardoso

On Tue, Aug 26, 2014 at 7:55 AM, Martin Hecht <[email-masked]> wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>