Subject: [pkix] Next edition of X.509

From: "Erik Andersen" <[email-masked]>
Date: Mon, 7 Dec 2015 11:33:18 +0100

In preparation for the next edition of X.509 (the 2016 edition), I have
forwarded to the ISO/IEC JTC1/SC6 two documents for three months ballots:

These two documents may be found as:

1.       http://www.x500standard.com/uploads/extensions/x509-pdam-amd2.pdf,
which is the 3rd PDAM text for an amendment to X.509.

2.       http://www.x500standard.com/uploads/dtc/X509-Ed7-Cor2.pdf, which a
second draft technical corrigendum. This technical corrigendum is based on a
set of defects reports, which include the justification for the changes. The
Defect reports may be found on
http://www.x500standard.com/index.php?n=Ig.DefectReports. 

An early corrigendum has been approved within ISO and ITU-T and may be found
as: http://www.x500standard.com/uploads/dtc/X509-Ed7-Cor1.pdf.

These three documents together with the seventh edition will provide the
input to the next edition of X.509. The different X.recommendations,
including X.509, may be found at http://www.itu.int/rec/T-REC-X/e. This
edition of X.509 is freely available in the PDF version.

Those involved in  ISO/IEC JTC1/SC6 can, of course, submit ballot comments
on the two documents out for ballot. Others, which may have comments on the
these document, may post them on the lists and after consolidation and
consensus, they may be issued as ITU-T comments.

It is important to check whether any of the suggested changes affects
running codes. If that is a case, it is a mistake.

The intension behind the changes has been:

1.       A better separation between public-key certificates and attribute
certificates. 

2.       Use of a consistent terminology. 

3.       Use of a consistent editing style in accordance with the ITU-T
editing guidelines.. 

4.       A new PKI component called trust broker assists a relying party
validating a public-key certificate is included. 

5.       IEC TC57 WG15 has identified a requirement for a feature first
called whitelist but now the term is authorization and validation list is
used. A proposal for such a feature is included in the amendment.

The main goal has been to position X.509 for new challenges, such  smart
grid security and security for Internet of Things with battery driven
devices, very short messages (can we put a 257 octets signature on a few
octets message?) , short reaction time requirements, many millions of
entities, etc. This is all very different from Web-based  systems.

Kind regards,

Erik

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 7 Dec 2015 10:45:19 +0000

Thank you Erik! Do I understand correctly that comments from
this list that you get before February are useful and that
sending comments to the pkix list works well enough for you?

If so, great, and I'd ask folks who care about RFC5280 or other
PKIX RFCs to please review this to check for any glitches that
might affect interop should new code be written based on the ISO
doc. I'm sure other comments are also welcome,

Cheers,
S.

On 07/12/15 10:33, Erik Andersen wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: "Erik Andersen" <[email-masked]>
Date: Mon, 7 Dec 2015 12:38:06 +0100

Hi Stephen,

I will collect any comment on any list. The goal is to get the best technical specification.

Regards,

Erik

-----Oprindelig meddelelse-----
Fra: Stephen Farrell [mailto:[email-masked]] 
Sendt: 07 December 2015 11:45
Til: Erik Andersen <[email-masked]>; Directory list <[email-masked]>; PKIX <[email-masked]>
Cc: [email-masked]
Emne: Re: [pkix] Next edition of X.509

Thank you Erik! Do I understand correctly that comments from this list that you get before February are useful and that sending comments to the pkix list works well enough for you?

If so, great, and I'd ask folks who care about RFC5280 or other PKIX RFCs to please review this to check for any glitches that might affect interop should new code be written based on the ISO doc. I'm sure other comments are also welcome,

Cheers,
S.

On 07/12/15 10:33, Erik Andersen wrote:
> In preparation for the next edition of X.509 (the 2016 edition), I 
> have forwarded to the ISO/IEC JTC1/SC6 two documents for three months ballots:
> 
>  
> 
> second draft technical corrigendum. This technical corrigendum is 
> based on a set of defects reports, which include the justification for 
> the changes. The Defect reports may be found on 
> These three documents together with the seventh edition will provide 
> the input to the next edition of X.509. The different 
> X.recommendations, including X.509, may be found at 
> http://www.itu.int/rec/T-REC-X/e. This edition of X.509 is freely available in the PDF version.
> 
>  
> 
> Those involved in  ISO/IEC JTC1/SC6 can, of course, submit ballot 
> comments on the two documents out for ballot. Others, which may have 
> comments on the these document, may post them on the lists and after 
> consolidation and consensus, they may be issued as ITU-T comments.
> 
>  
> 
> called whitelist but now the term is authorization and validation list 
> is used. A proposal for such a feature is included in the amendment.
> 
> The main goal has been to position X.509 for new challenges, such  
> smart grid security and security for Internet of Things with battery 
> driven devices, very short messages (can we put a 257 octets signature 
> on a few octets message?) , short reaction time requirements, many 
> millions of entities, etc. This is all very different from Web-based  systems.
> 
> Kind regards,
> 
> Erik
> 
>  
> 
>  
> 
>  
> 
> 
> 
>

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 7 Dec 2015 12:01:55 +0000

> I will collect any comment on any list. The goal is to get the best technical specification.

Excellent. I hope folks will read and comment so. (And I've
added it to my todo list, but that's fairly long at the
moment;-)

Ta,
S.