Subject: Re: [Nea] [pkix] New Draft about X.509extension with Security Information

From: Stephen Hanna <[email-masked]>
Date: Sat, 16 Oct 2010 17:14:52 -0400

Yuting,

Thanks for your interesting contribution.

Are you familiar with the work of the IETF NEA WG? We are defining protocols for remote assessment of endpoint posture. One of the features called out in our requirements document (RFC 5209) is the Assertion Attribute, reusable evidence of the results of an assessment. We have not yet defined any standard Assertion Attributes but a certificate with your suggested extension or some variant thereof could serve as an Assertion Attribute. Microsoft has implemented a similar concept in their Network Access Protection (NAP) system. They call it a Health Certificate.

Since this work is mainly concerned with endpoint assessment and only peripherally with X.509 certificates, I suggest that you come talk to the NEA Working Group, where we have a lot of experience with endpoint posture assessment. For example, we already have a standard (RFC 5792) for conveying information about endpoint posture (e.g. anti-virus status). This should be beneficial in your efforts. It would ease matters for implementers and avoid the need to reinvent things. If any posture attributes are missing from RFC 5792, we have a well-defined way to add them.

Will you be coming to the IETF 79 meeting in Beijing? If so, I would invite you to present your draft at the NEA WG meeting there and to discuss how your draft can be reconciled with the NEA documents.

Thanks,

Steve Hanna
NEA WG Co-Chair

From: [email-masked] [mailto:[email-masked]] On Behalf Of ???
Sent: Friday, October 15, 2010 6:20 AM
To: [email-masked]
Subject: [pkix] New Draft about X.509extension with Security Information

Dear all,

We have submitted a new Internet draft entitled "X.509extension with Security Information"
It can be accessed at:
http://www.ietf.org/id/draft-chen-pkix-securityinfo-00.txt
Any comments are welcome. Thanks.

Abstract:
This document defines an X.509v3 certificate extension. It binds a list of security information to the subject of a certificate, which may be used to cognize the security posture of the subject.

Best Regards,
Yuting Liu

--
Best regards,
刘玉婷 Vivi
Phone:13488659413
Email: [email-masked]<mailto:[email-masked]>
MINE | Mobile LIfe and New Media LAB
BUPT | Beijing University of Posts and Telecommunications

---

From: 刘玉婷 <[email-masked]>
Date: Wed, 20 Oct 2010 13:13:20 +0800

Hi,

   We will attend IETF 79 meeting in Beijing.

   We have read NEA WG documents, and we can discuss the reconcile things
then.It would be our pleasure if we can make any contribution.

   Thanks.

Yuting Liu

2010/10/17 Stephen Hanna <[email-masked]>

> Are you familiar with the work of the IETF NEA WG? We are defining
> protocols for remote assessment of endpoint posture. One of the features
> called out in our requirements document (RFC 5209) is the Assertion
> Attribute, reusable evidence of the results of an assessment. We have not
> yet defined any standard Assertion Attributes but a certificate with your
> suggested extension or some variant thereof could serve as an Assertion
> Attribute. Microsoft has implemented a similar concept in their Network
> Access Protection (NAP) system. They call it a Health Certificate.
>
>
>
> Since this work is mainly concerned with endpoint assessment and only
> peripherally with X.509 certificates, I suggest that you come talk to the
> NEA Working Group, where we have a lot of experience with endpoint posture
> assessment. For example, we already have a standard (RFC 5792) for conveying
> information about endpoint posture (e.g. anti-virus status). This should be
> beneficial in your efforts. It would ease matters for implementers and avoid
> the need to reinvent things. If any posture attributes are missing from RFC
> 5792, we have a well-defined way to add them.
>
>
>
> Will you be coming to the IETF 79 meeting in Beijing? If so, I would invite
> you to present your draft at the NEA WG meeting there and to discuss how
> your draft can be reconciled with the NEA documents.
>
>
>
> Thanks,
>
>
>
> Steve Hanna
>
> NEA WG Co-Chair
>
>
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf Of
> *???
> *Sent:* Friday, October 15, 2010 6:20 AM
> *To:* [email-masked]
> *Subject:* [pkix] New Draft about X.509extension with Security Information
>
>
>
> Dear all,
>
> This document defines an X.509v3 certificate extension. It binds a list of
> security information to the subject of a certificate, which may be used to
> cognize the security posture of the subject.
>
> Best Regards,
> Yuting Liu
>
>
> --
> Best regards,
> 刘玉婷 Vivi
>
> Phone:13488659413
> Email: [email-masked]

-- 
Best regards,
刘玉婷 Vivi
Phone:13488659413
Email: [email-masked]
MINE | Mobile LIfe and New Media LAB
BUPT | Beijing University of Posts and Telecommunications