Subject: RE: PKINIT open issues

From: "JK Jaganathan" <[email-masked]>
Date: Wed, 21 Apr 2004 12:33:10 -0700

The OCSP tunneling logically belongs in the PKINIT draft. I haven't heard any clear arguments for moving it to another draft other than 'it can be done'. I don't see how it would hold up the PKINIT draft in anyway. What are the major technical objections here? The same work has already been done for TLS so we are not doing something that is a major addition. 
I very much doubt the OCSP work would be standardized if we had to go through a whole separate draft process. 

________________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Jeffrey Altman
Sent: Tuesday, April 20, 2004 12:45 PM
To: [email-masked]
Subject: Re: PKINIT open issues

Nicolas Williams wrote:

I'm for moving the OCSP tunneling to a separate draft.  It's a new
feature that, unlike the CAs-verified authz-data element, isn't crucial
for security and interoperability, even if it is desirable.

Nico
I concur.  OCSP should be moved to a new draft.

Jeffrey Altman

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 21 Apr 2004 14:41:55 -0500

I'll repeat:

 - OCSP tunnelling is NOT absolutely necessary for secure, interoperable
   use of PKINIT;

 - Given this it's obviously ok to move OCSP tunnelling to a separate
   draft;

 - Finally, if it looks like OCSP tunnelling may delay PKINIT, then
   given the above, we really should move OCSP tunnelling to a separate
   draft.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Wed, 21 Apr 2004 18:41:42 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> I'll repeat:
    Nicolas>  - OCSP tunnelling is NOT absolutely necessary for secure, interoperable
    Nicolas>    use of PKINIT;

    Nicolas>  - Given this it's obviously ok to move OCSP tunnelling to a separate
    Nicolas>    draft;

Only true if someone is actually going to do the work.

If this WG believes that OCSP tunneling is important and believes the
work will only get done if it is bound to pkinit, then it is
reasonable and appropriate for us to bind the two.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 21 Apr 2004 18:06:51 -0500

> reasonable and appropriate for us to bind the two.

Sure.  My third point was that we should move OCSP tunnelling out of
PKINIT if it looks like working it out would hold up PKINIT.  This is
not incompatible with your position.

Nico
--

---

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 22 Apr 2004 09:49:26 -0500

> reasonable and appropriate for us to bind the two.

I would say that PKINIT has been delayed for so long, that we need to get it out. 

So unless there is some reason that PKINIT can not be usefull without having OCSP
in the ducument, (does anyone have a good argument for this?) , then OSCP could 
be seperate so we can get PKINIT out. 

Do the Cablelabs people have any specific comments on this?   

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444