Subject: Re: KISS for PKIX. (Was: RE: ASN.1 vs XML (used to be RE: I-D ACTION:draft-ietf-pkix-scvp- 00.txt))

From: "Mark Ciccarello" <[email-masked]>
Date: Wed, 14 Jul 1999 21:03:14 -0400

Hello Bill

I'd like to endorse your message and the previous one ("average user").

The realities you allude to have profound implications as to what type
of PKIs can successfully be deployed and effectively utilized inside a
large organization.  I do not think this is a problem peculiar to
"government" organizations.

[My own personal views, but I could add to your volumes]

Mark Ciccarello
-----Original Message-----
From: Flanigan, Bill <[email-masked]>
To: 'Michael Myers' <[email-masked]>
Cc: [email-masked]' <[email-masked]>
Date: Wednesday, July 14, 1999 9:03 AM
Subject: KISS for PKIX. (Was: RE: ASN.1 vs XML (used to be RE: I-D
ACTION:draft-ietf-pkix-scvp- 00.txt))

>Hello Mike,
>
> You are on the right track (and so, I think, is Steve).  Before PKI
>technologies (and other IETF *core* security protocol suites) can be *main
>streamed,* they must be made very easy to use across the board--from
>implementers to developers to end (human) entities.  Some might object to
>this as being *dumbed down,* but lack of interoperability due to overly
>complex and convoluted multi-protocols (not to mention competing protocols)
>is a real problem.  So is the resulting complexity of use experienced by
EEs
>(I could write volumes here!).  Unless we aim for the *lowest common
>denominator,* CIOs will never be able to show ROIs to justify PKI (and
>especially the PKIX favor of PKI) purchases.  We have probably all read
>recent reports that Fortune 1,000 CEOs see IT, in general, and PKI, in
>particular, as simply drains on profits; and in the UK, companies don't
seem
>to be interested in PKI (and especially the PKIX flavor of PKI) at all.  As
>usual, KISS is the key (no pun intended).  I fear that we do not have the
>luxury of tossing things over the fence to *let the market decide.*  The
>market may decide to pass.
>
>Bill
>
>> ----------
>> From: Michael Myers[SMTP:[email-masked]]
>> Sent: Tuesday, July 13, 1999 9:29 PM
>> To: 'Stephen Kent'; Anders Rundgren
>> Cc: 'Peter Sylvester'; [email-masked]'
>> Subject: RE: ASN.1 vs XML (used to be RE: I-D
>> ACTION:draft-ietf-pkix-scvp- 00.txt)
>>
>> Steve,
>>
>> I'll probably bring this point to your attention on the floor before you
>> read this email, but for the record (and further, for the benefit of
those
>> unable to attend the Oslo session), I would claim that making PKI easy
for
>> developers is a very good thing.  Your comment belows seems to modestly
>> suggest that such an objective is less worthy than it might ought to be.
>>
>> Indeed, this principle was the primary motivation for OCSP's original
>> non-ASN.1 proposal.
>>
>> Mike
>>
>>
>>
>> > -----Original Message-----
>> > From: Stephen Kent [mailto:[email-masked]]
>> > Sent: Tuesday, July 13, 1999 12:28 AM
>> > To: Anders Rundgren
>> > Cc: 'Peter Sylvester'; [email-masked]'
>> > Subject: RE: ASN.1 vs XML (used to be RE: I-D
>> > ACTION:draft-ietf-pkix-scvp-00.txt)
>> >
>> >
>> > Anders,
>> >
>> >
>> > >The important thing is that in order to make PKI a
>> > main-stream technology
>> > >(which it is
>> > >not today), may require changes like going to XML as XML is likely to
>> > >at least replace EDI which is often used in the same contexts as
>> > >certificates (or
>> > >rather should be).  So if XML becomes the HTML (which is closer to a
>> > >"peoples movement" than a computer language) of business
>> > messages, ASN.1
>> > >may be too obscure (few know it) and less satisfactory as a long-term
>> > >solution.
>> > >
>> > >This should be seen in the light of the fact that the only
>> > main-stream
>> > >PKI-application
>> > >I can think about, is e-commerce.  As very few e-commerce
>> > standards are ready
>> > >for prime time, there is plenty of room for new things.
>> >
>> > There seems to be an implication here that mainstream users
>> > want to be able
>> > to read the signed data in its native format, and thus XML encoding is
>> > preferable to DER.  But we know this is not true, i.e.,
>> > whatever has been
>> > signed will be decoded prior to display, and then rendered
>> > for the user.
>> > So, it would seem that the use of an encoding scheme such as
>> > XML would be
>> > more attractive for developers performing debugging, rather
>> > than for users.
>> >
>> > Steve
>> >
>>
>