Subject: Re: LAST CALL: draft-ietf-pkix-cmc-05.txt

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 27 Jul 1999 13:59:59 -0700

At 01:12 PM 7/27/1999 -0700, Warwick Ford wrote:
>This document is hereby issued for 14-day WG last call.

OK, here's a tricky question: has anyone actually implemented the current 
draft? If not, should we try to move it forwards?

I ask this because of the dismal track record of CMP. Many months after it 
was put on standards track, interoperability testing began, and it was 
found to be a nightmare that will almost assuredly cause the spec to be 
rewritten for clarification, and possibly to change bits on the wire. (See 
draft-moskowitz-cmpinterop for more information on the testing.)

If no one has what they think of as a full implementation of CMC, I propose 
that we wait until at least one person does. If we have only one 
implementation of CMC, I suggest that we ask for it to be made an 
Experimental Standard instead of a Proposed Standard. If we have two 
implementations that can at least talk to each other a little bit, let's 
try to get it to become a Proposed Standard.

I realize that these are *not* the rules as defined in RFC 2026, but due to 
our lack of attention on CMP, I think we have to be more careful with CMC.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: "tog" <[email-masked]>
Date: Tue, 27 Jul 1999 18:15:28 -0700

All
----- Original Message -----
From: Paul Hoffman / IMC <[email-masked]>
To: <[email-masked]>
Sent: Tuesday, July 27, 1999 1:59 PM
Subject: Re: LAST CALL: draft-ietf-pkix-cmc-05.txt

> draft? If not, should we try to move it forwards?

My feeling is that the protocol model is robust enough so that it deserves
to get advanced, however we have these POISED requirements, so maybe if we
do not advance it then we should at least mark it as "automatically
advanced" as soon as the advancement criteria is met -poof its done.

This leaves it up to the sponsors to actually make sure that their efforts
are successful and that they have two impliementations of their beast as per
the RFC2026 requirements. But it also enables that any technology
specification should fast track through approval if it satisfies the staging
requirements in 2026. I think this is a really good idea, myself.

This effort might actually take a change to RFC2026, but is likely that also
that the WG Chairs can agree that within PKIX such a status exists. Yo
Warwick and Stephen, does this work for the groups purposes?.

--- SNIP ---

---

From: Robert Moskowitz <[email-masked]>
Date: Fri, 30 Jul 1999 09:59:48 -0400

>draft? If not, should we try to move it forwards?

The IETF has long since moved away for those days where it documented what
engineers got to work to now where it documents what engneers THINK they
can get to work.  We all know that and try to get on with our lives.  Of
course we have sold the media the original bill of goods...

>draft-moskowitz-cmpinterop for more information on the testing.)

Well, the RFC is dated Mar '99 and the first interop testing was in May
'99.  As you have indicated, you have run workshops.  I would think that 2
months from first planing meeting to engineers with code in a room is
pretty good.

Now for perhaps the first time we actually capture the lessons learned in
the workshop for all of those that are tuning up their programming engines.
 Specs often are sparse, and authors sometimes loose the forest for the
trees.  So when you get two minds (and sometimes two cultures, Canadian and
Irish :) actually we had much of the english flavor there:  American,
Canadian, English, Irish; all we needed where the OpenSSL Austrialians :) )
together you can learn ways to improve on spec clarity.  Most of the items
raised at the wrokshops center on spec clarity.

The sooner spec clarity is addressed the sooner newcomers will Do It Right
The First Time  (DIRTFoot, a business culture we cultivated back at
Chrysler).  Now I am NOT taking shots at any author.  We can all improve
our writing, and spec writing is NOT easy.  I know that IPsec gained a lot
when the SSH fellows read the specs.

>try to get it to become a Proposed Standard.

Boy I would LOVE to get changes like this through POISSON.  But business
reality blocks us.  We had many IAB/IESG debates on this and got no where.

HOWEVER, a community that can go to their consumers with strong statements
that "we worked these specs through REAL code and REAL WORLD scenarios"
will get faster acceptance IMHO.

>our lack of attention on CMP, I think we have to be more careful with CMC.

Gee it would be nice, and I am willing (though my 4 cyclinder is perhaps
not able) to pitch in.

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]