Subject: [pkix] possible new pkix and/or smime work

From: Stephen Farrell <[email-masked]>
Date: Wed, 23 Mar 2016 20:35:25 +0000

Folks,

I'm finding it hard to evaluate the discussion as to whether
there's new work folks want to do here that'd justify forming
a (coherent) WG and that'd result in likely implementation and
deployment. I expect others may be similarly uncertain.

Would someone be willing to volunteer to act in a slightly
chair-like manner and try to summarise the discussion in a
way that might help us judge the above?

I think that might help us to e.g. organise a bit of a bar
BoF or collective chat amongst those interested while a bunch
of us are in B-A and on the list prior to that.

Thanks,
S.

PS; If you are willing to do that but shy, feel free to send to
me offlist and I can pretend I did the work:-)

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Mar 2016 12:28:24 +0000

I got a couple of volunteers, Wei Chuang and John Levine
(thanks both!) who're aiming to produce us a summary of
the recent list discussion we can ponder in a few days.

Cheers,
S.

On 23/03/16 20:35, Stephen Farrell wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 24 Mar 2016 14:18:10 +0100

> deployment. I expect others may be similarly uncertain.

This discussion lacks an important element; the browser vendors' deprecation of client-side certificates.
Microsoft have already removed support for on-line provisioning of certificates in Edge (the successor of Internet Explorer) and now Google and Mozilla have also joined the club:

https://lists.w3.org/Archives/Public/www-tag/2016Mar/0001.html

Anders

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Mar 2016 13:22:50 +0000

> deprecation of client-side certificates.

I don't agree that that's relevant to whether or not there's new
work people want to do in a revived PKIX/SMIME extension WG. That
is because nobody so far wanted to do work related to web user
authentication. So while such changes might be interesting they are
just not relevant to this discussion as far as I can see.

S.

> Microsoft have already removed support for on-line provisioning of
> certificates in Edge (the successor of Internet Explorer) and now Google
> and Mozilla have also joined the club:
>

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 24 Mar 2016 14:28:35 +0100

> just not relevant to this discussion as far as I can see.

How do you anticipate that S/MIME certificates are distributed?
On smart cards?  Well, then we are talking about a more scoped
scenario which (for example) eliminates Yahoo! from the plot.

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 24 Mar 2016 13:43:42 +0000

> How do you anticipate that S/MIME certificates are distributed?

Not via web browsers using TLS client auth. Changing the topic
entirely and almost at random isn't useful.

And in general, it's not useful for this discussion to wander
(it's wandered enough). If you Anders want to propose some
relevant new work, please write an I-D. (Same goes for anyone.)

In case it isn't clear to you or the list - as an AD I will not be
proposing to the IESG or IETF that we spin up a new WG to boil
any oceans, not a PKI ocean, nor an SMIME ocean, nor any other.

If there are specific bits of sensible work that folks are willing
to make the effort on, and if those seem likely to be implemented and
deployed then I'll be positive.

But I am just not interested in helping with random discussion of
principles, possibilities, all the things that are wrong with the
world or angels on the head of pins.

So to re-iterate (just in case more emphasis is needed:-) - if you
want something substantively discussed, write an I-D that is relevant
to the ex-PKIX or ex-SMIME WGs and come up with good-enough answers
as to how your stuff is likely to get implemented and deployed.

Cheers,
S.