[KEYPROV] KEYPROV vs. KeyGen/Xenroll/generateCRMFrequest

["Rundgren, Anders" <arundgren at rsasecurity.com>]

Dear all,

Although only being an occasional lurker on this list, may I comment
on the tentative specifications anyway?
 
The three (PKI) key provisioning mechanisms mentioned in the subject
line are quite different from each other but have one thing in common
and that is that they are primarily used in conjunction with browser-
based processes.

Note that although browsers indeed use HTTP, "HTTP-bindings" are not
equivalent to "browser-bindings" because the latter require links
to the browser platform which may constitute of Javascript objects,
dedicated MIME-types, or specific HTML tags.

Among benefits of using browser-based key provisioning processes
I would include:

- Elimination of user/session authentication elements in the protocol
  itself by reusing existing web technology

- Efficient provisioning processes where invocation URLs can be sent
  through e-mail and SMS and then clicked on by the user

- High flexibility regarding the orchestration of the provisioning
  process
 

KEYPROV seems to depart from this fairly established paradigm.
 
Is there a rationale for taking this direction, apart from the
obvious hurdle of getting browser vendors interested?

Anders Rundgren

_______________________________________________
KEYPROV mailing list
KEYPROV at ietf.org
https://www1.ietf.org/mailman/listinfo/keyprov