PKIX WG Meeting 3/1/04

Edited by Steve Kent

Chairs: Stephen Kent <kent@bbn.com> & Tim Polk 
<tim.polk@nist.gov>

The PKIX WG met once during the 59th IETF. A total of 
approximately 49 individuals participated in the meeting.


Agenda review and document status - Steve Kent (BBN) using slides from Tim 
Polk (NIST)
       The backlog of WG documents has subsided a bit. Several new RFCs 
have been issued, or will be issued soon.  Logotypes was issued as RFC 
3709. Proxy certificates is in the RFC editors queue as is the IP 
address and AS identifier document. Qualified certificates has been 
approved by the IESG.  The warranty extension document requires 
revisions before being forwarded to the RFC editor.
       Several documents are in the hands of the ADs: permanent 
identifier, attribute certificate policies, extensions for wireless LANs, 
and repository locator service.  CRMF and CMP require revisions before 
progressing. SCVP and PK algorithms are in WG last call. The path 
building and ECC (NIST curves) documents are ready for last call, and SIM is 
getting closer. LDAP specs, and OCSPv2 extensions are ongoing work items.  
Interoperability tests are being performed by several vendors, in 
preparation for progression of RFCs 3279/3280.

Subject Identification Method - Jongwook Park (KISA)
        This presentation reviewed changes from previous draft, and 
responses to 21 comments received during WG last call.

CRMF (RFC 2511bis) - Jim Schaad (Soaring Hawk Consulting)
     Jim took over as editor, and has made significant updates. He sees 
several outstanding issues yet to be resolved, that are blocking 
progress. Some of the POP methods appear to be vulnerable, and thus need to 
be dropped or fixed. Also, the DH-MAC POP algorithm should be made more 
algorithm generic, e.g., to accommodate ECC algorithms. Need to fix some 
underspecified parts of registration token, archival, and 
registration info features of the protocol. Will take this up on the list to 
determine how critical these features are, especially with regard to POP. 
Possible outcomes are: removal of some (or all) of these features, or 
fixes that address the problems.

RFC 3039bis (Qualified Certificates) - Russ Housley (Vigil Security)    
        Russ reviewed the sequence of events associated with a large 
number (38) of comments received from Denis Pinkas during the IETF Last 
Call for this document. At this point there are only five comments 
outstanding, and all are essentially editorial in nature. However, if the 
document is to be changed to accommodate these remaining changes, it will be 
necessary to reprocess the document through a 7-step process. Thus the WG 
has a choice: option 1: it can proceed with the document in its current 
form; option 2: it can make the suggested changes, and proceed with the 
7-setp process Russ outlined. Russ asked for a show of hands from 
attendees as to which option was preferred. Russ invited comments from the 
floor on the choices, and several individuals expressed the opinion that the 
first three comments are trivial editorial changes that could be made 
during the RFC editor's 48-hour final revision interval. Several folks 
expressed the opinion that the security considerations text should appear in a 
more general document, e.g., RFC 3280. The show of hands indicated that the 
attendees strongly preferred the first option, although there were a few 
hands in support of option two.