Subject: Re: [lamps] Liaison Statement to ISO/TC 154

From: Russ Housley <[email-masked]>
Date: Thu, 4 Feb 2021 11:02:49 -0500

After some discussion with people that have been liaison manager to other ISO Technical Committees, so rewording was suggested.  Please review and comment.  If I do not hear any concerns is the next few days, I'll send this version to the IAB.

Russ

== == == == ==

FROM: IAB
TO: ISO/TC 154

The Internet Architecture Board (IAB) would like to make sure that you are aware of the recent work by the at IETF LAMPS Working group (https://tools.ietf.org/wg/lamps/).  The LAMPS WG is responsible for updates to IETF documents related to public key infrastructure (PKI), including the Online Certificate Status Protocol (OCSP). OCSP is specified in RFC 6960 (https://www.rfc-editor.org/rfc/rfc6960.txt).  As part of the work of the LAMPS Working Group, RFC 8954 (https://www.rfc-editor.org/rfc/rfc8954.txt) was published as an update to RFC 6960, which limits the size of the OCSP Nonce extension to 32 octets to make the OCSP transactions more secure.  The OCSP Nonce is a randomly generated value that cryptographically binds a request and a response to prevent replay attacks.

The IAB has been notified that RFC 8954 may conflict with the way OCSP Nonce extension is used in ISO 14533-4.  We are writing to share that concern.  We understand that ISO 14533-4 places a non-random value in the OCSP Nonce that is larger than 32 octets.  This new size limitation may also impact other work by ISO/TC 154 that we are not aware of.

We had a discussion about the use case in the LAMPS Working Group recently. Based on how the OCSP nonce extension is used in the industry, it was recommended that a new OCSP extension should be used for the purpose of capturing OCSP response for long term validation of the signed documents.

We recognize that the IETF does not have a liaison relationship with ISO/TC 154; however, the IETF LAMPS Working Group would like to work with you to resolve this incompatibility in the best possible way.  If the establishment of a liaison relationship between the IETF and ISO/TC 154, then the IAB will coordinate the arrangement.

Thank you for you attention in this matter.

---

From: Tim Hollebeek <[email-masked]>
Date: Thu, 4 Feb 2021 20:37:25 +0000

LGTM

> -----Original Message-----
> From: Spasm <[email-masked]> On Behalf Of Russ Housley
> Sent: Thursday, February 4, 2021 11:03 AM
> To: LAMPS <[email-masked]>; Roman D. Danyliw <[email-masked]>
> Subject: Re: [lamps] Liaison Statement to ISO/TC 154
> 
> After some discussion with people that have been liaison manager to other
> ISO Technical Committees, so rewording was suggested.  Please review and
> comment.  If I do not hear any concerns is the next few days, I'll send
this
> version to the IAB.
> 
> Russ
> 
> == == == == ==
> 
> 
> FROM: IAB
> TO: ISO/TC 154
> 
> The Internet Architecture Board (IAB) would like to make sure that you are
> aware of the recent work by the at IETF LAMPS Working group
> (https://tools.ietf.org/wg/lamps/).  The LAMPS WG is responsible for
updates
> to IETF documents related to public key infrastructure (PKI), including
the
> Online Certificate Status Protocol (OCSP). OCSP is specified in RFC 6960
> (https://www.rfc-editor.org/rfc/rfc6960.txt).  As part of the work of the
> LAMPS Working Group, RFC 8954 (https://www.rfc-editor.org/rfc/rfc8954.txt)
> was published as an update to RFC 6960, which limits the size of the OCSP
> Nonce extension to 32 octets to make the OCSP transactions more secure.
> The OCSP Nonce is a randomly generated value that cryptographically binds
a
> request and a response to prevent replay attacks.
> 
> The IAB has been notified that RFC 8954 may conflict with the way OCSP
> Nonce extension is used in ISO 14533-4.  We are writing to share that
concern.
> We understand that ISO 14533-4 places a non-random value in the OCSP
> Nonce that is larger than 32 octets.  This new size limitation may also
impact
> other work by ISO/TC 154 that we are not aware of.
> 
> We had a discussion about the use case in the LAMPS Working Group
> recently. Based on how the OCSP nonce extension is used in the industry,
it
> was recommended that a new OCSP extension should be used for the purpose
> of capturing OCSP response for long term validation of the signed
documents.
> 
> We recognize that the IETF does not have a liaison relationship with
ISO/TC
> 154; however, the IETF LAMPS Working Group would like to work with you to
> resolve this incompatibility in the best possible way.  If the
establishment of a
> liaison relationship between the IETF and ISO/TC 154, then the IAB will
> coordinate the arrangement.
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Russ Housley <[email-masked]>
Date: Fri, 5 Feb 2021 14:01:56 -0500

Dear IAB:

After some discussion with people that have been liaison manager to other ISO Technical Committees, some rewording was suggested.  The wording was then reviewed by the LAMPS WG.  Here is the revised liaison statement.

Russ

== == == == ==

FROM: IAB
TO: ISO/TC 154

---

From: "[email-masked]" <[email-masked]>
Date: Sun, 7 Feb 2021 23:43:41 +0800

Dear Russ,

      Thanks for your hard work.

     One comment:

      A few days ago, I had a chance to talk with one ISO person. He asked "We know a little about IETF, but do not know IAB. What is the relationship between IAB and IETF?".
     I suggest to add a reference or simple explanation to "The Internet Architecture Board (IAB) " in the first sentence "The Internet Architecture Board (IAB) would like to make sure that". 

Best Regards
Jiankang Yao

From: Russ Housley
Date: 2021-02-06 03:01
To: IAB
CC: LAMPS; Roman D. Danyliw
Subject: Re: [IAB] Liaison Statement to ISO/TC 154
Dear IAB:

Russ
 
== == == == ==

FROM: IAB
TO: ISO/TC 154

---

From: Mirja Kuehlewind <[email-masked]>
Date: Mon, 8 Feb 2021 12:12:21 +0100

Hi Jiankang, hi all,

Good comment. I guess could simply say:

"The Internet Architecture Board (IAB), which is handling the liaison management of the IETF, would like to make sure that you are aware of the recent work by the at IETF LAMPS Working group (https://tools.ietf.org/wg/lamps/).”

Okay?

Mirja

> On 7. Feb 2021, at 16:43, [email-masked] wrote:
> 
> Dear Russ,
> 
>

---

From: "Jiankang Yao" <[email-masked]>
Date: Mon, 8 Feb 2021 22:12:24 +0800 (GMT+08:00)

It is ok for me.
Thanks.

Jiankang Yao

>
> From: "Mirja Kuehlewind" <[email-masked]>
> Date: 2021-02-08 19:12:21 
> To: yaojk <[email-masked]>
> Cc: housley <[email-masked]>, IAB <[email-masked]>, LAMPS <[email-masked]>, "Roman D. Danyliw" <[email-masked]>

---

From: Alissa Cooper <[email-masked]>
Date: Mon, 8 Feb 2021 09:28:56 -0500

Thanks Russ! LGTM. There is a problem in the last sentence though, I think it needs to say “If the establishment of a liaison relationship between the IETF and ISO/TC 154 is desired …”

Alissa

> On Feb 5, 2021, at 2:01 PM, Russ Housley <[email-masked]> wrote:
> 
> Dear IAB:
>

---

From: Russ Housley <[email-masked]>
Date: Mon, 8 Feb 2021 10:35:16 -0500

Yes, the "if desired" got dropped somehow.  Thanks,

Russ

> On Feb 8, 2021, at 9:28 AM, Alissa Cooper <[email-masked]> wrote:
>