Subject: I-D ACTION:draft-bellovin-ipsra-getcert-00.txt

From: [email-masked]
Date: Thu, 17 Feb 2000 06:27:13 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: Client Certificate and Key Retrieval for IKE
	Author(s)	: S. Bellovin, R. Moskowitz
	Filename	: draft-bellovin-ipsra-getcert-00.txt
	Pages		: 9
	Date		: 16-Feb-00
	
(Insert justification, possibly copied wholesale from section 1.1 and
maybe 2.1/2.2 of draft-kelly-ipsra-userauth-00.txt)
We consider inadvisable to change IKE [RFC2409] to meet these needs.
IKE is a complex protocol; adding more features to it is a bad idea.
Instead, we propose a layered approach:  use standard IKE, with
certificates, but provide a simple mechanism to provide clients with
keys and certificates.
A number of objections have been raised to using certificates.  The
most important is that we lack a public key infrastructure (PKI).  We
do not agree that this is an obstacle.  Our proposal provides a
simple mechanism for certificate generation and retrieval, while
still relying on legacy authentication infrastructures.  Furthermore,
we provide for an easy migration path to certificate use once
organizational PKIs are deployed.
Our purpose at this point is not to present a firm protocol.  Rather,
we sketch several ideas for what such a protocol could look like.
Final details can be determined if and when the working group opts
for this path.
In the interests of simplicity, we have chosen to reuse standard
protocols and components.  In particular, we use HTTP [RFC2616] for
transport, HTML [RFC1866] as a data representation and TLS [RFC2246]
for confidentiality.  However, we do not mandate (or even necessarily
encourage) use of a actual Web browser for certificate retrieval.
As an alternative, we present a transient shared secret generation
mechanism for IKE.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-bellovin-ipsra-getcert-00.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-bellovin-ipsra-getcert-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-bellovin-ipsra-getcert-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.