Subject: RE: Withdrawl of Proxy Cert Profile draft from PKIX

From: Peter Williams <[email-masked]>
Date: Tue, 03 Sep 2002 06:09:19 -0700

Linn and Kent directed IETF towards an Internet PKI
based on organizational affiliation; records show that
considerable effort since 1987 has been put into denying 
users (in  PEM/PKIX worlds) the ability to act as certificate 
issuers.

Read RFC 1040/1113, and its clear that Steve at least
concedes that X.509 permits users to be CAs. The documents
are clear that part of the (old) motivation for
the limitations PEM/PKIX still places on the X.509
model were to do with the historical need to 
to flow revenues to a patent licensee, per-certificate. 
Organizational certification supported that goal, which
was important to the Internet PKI at the time. Its very
hard to deny the legitimacy of either model, note: 1040 
re-emerged as the wildy successful VeriSign Onsite, and 
1422's ON model is still in vouge in  US/CA military 
messaging infrastructures.

In terms of consensus, I doubt we can obtain any
on this issue in IETF. There are simply two worlds: the world
of the philosophy of PKIX, and reality of actual needs and 
legacy support. Both world views are convincing and laudable; convergence is
unlikely. Matters of policy and application really
dont need PKIX WG involvement, however. All the commodity
software out there is entirely customisable in the
field, and vendor-working groups are probably a better
forum than PKIX - which properly concentrates on leading,
if not fulfilling, the long term infrastructure vision.

----------------

But that is where I see that the problem lies.  As I mentioned in my 
previous emails, we have also had conversations with PKIX people that
led 
to my belief that there may we irreconcilable differences of opinion
about 
this approach.  There are those who apparently believe that the approach
is 
fundamentally at odds with X.509 and PKIX world views, and should not be

sanctioned.

---

From: Peter Williams <[email-masked]>
Date: Tue, 03 Sep 2002 06:08:23 -0700

----------------

sanctioned.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Sep 2002 11:41:05 -0700

Answer: Start a new group

PKIX was formed to do one thing and has become a standing committee that
will do anything, provided it is in ASN.1 syntax. That is a bad thing. 

I would much prefer to see the group split into two. Continuing PKIX would
be tasked with simply moving the current RFCs through the standards track to
Draft and Standard. PKIX-EXT would be tasked with developing extensions to
PKIX where necessary.

		Phill