Subject: RE: Yes, and remove more of the alphabet from the PKIX soup

From: Eric Bomarsi <[email-masked]>
Date: Thu, 11 Feb 1999 12:23:31 -0500

I am trying to understand the relationship between the various
certificate enrollment protocols and came across this archived
email thread.

Since then, CMP is going to RFC, CMMC seems to be
going away, and CMC work continues. Correct?

So can someone with experience in each of these please
summarize the merits of each?

Is CMC a follow-on to CMP and intended to improve some
deficiencies, or are they competing protocols.

Thanks in advance,
Eric Bomarsi

======================================================

      To: [email-masked]
      Subject: RE: Yes, and remove more of the alphabet from the PKIX soup (Was: RE: Can we now kill
CMMF?)
      From: Warwick Ford <[email-masked]>
      Date: Fri, 18 Dec 1998 12:49:16 -0800
      Sender: [email-masked]

I think we all want to see the document structure rationalized, but I would
not want that objective to destabilize completion of the protocol specs.  I
see it as follows:  CMP and CRMF are (virtually) Proposed Standards now, and
we do not want to disturb them.  In their next iteration, we could certainly
consider folding CRMF into the CMP spec.  CMC has done the right thing in
eliminating its dependence on CMMC, so we are probably now able to drop CMMC
as Al proposed.  It is OK for CMC to reference CRMF for now; but the CMC
authors might consider folding in CRMF as well at some stage -- maybe a
future iteration, to be sure such a move does not disrupt publication of the
first CMC Proposed Draft.  However, it would not be helpful to try to merge
CMP and CMC at this stage -- this is something we can look at later on, in
the light of experience in implementing these protocols.

Warwick

> -----Original Message-----
> From: Aram Perez [mailto:[email-masked]]
> Sent: Friday, December 18, 1998 10:35 AM
> To: [email-masked]
> Subject: Re: Yes, and remove more of the alphabet from the PKIX soup
> (Was: RE: Can we now kill CMMF?)
>
>
> I like Bill suggestion. Less documentation is better (KISS ;-)
>
> Aram Perez
> Apple Computer, Inc.
>
> >Folks,
> >
> > 1.  I second Al's motion!
> >
> > 2.  Now, let's start working on reducing some more of this PKIX
> >alphabet-soup nonsense.
> >
> > 3.  Prime candidates would seem to include (for now) CRMF, CMP, and
> >CMC.  All can/should be rolled into one document.
> >
> > 4.  Since CMC is essentially a superset of CMMF and CRMF, the latter
> >two can/should be collapsed into the former.
> >
> > 5.  Since CMP and CMC/CMMF/CRMF are essentially supersets of one
> >another, one can/should be collapsed into the other.
> >
> > 6.  Since CMC/CMMF/CRMF is of more recent vintage, and currently
> >under very active and broad-based discussion, it will likely
> reflect many
> >new lessons learned (especially from the real world of
> registration), and
> >ipso facto obsolete CMP.
> >
> > 7.  So why not cut to the chase and collapse CMP into CMC/CMMF/CRMF
> >now?
> >
> > 8.  This will leave us with one, combined, substantially-revised,
> >updated, integrated, and thoroughly-scrubbed document:  the
> "new CMC".
> >One-stop shopping for implementers!  Interoperability
> nirvana at long last!
> >
> > Comments?
> >
> >Bill
> >
> >%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
> >William F. Flanigan, Jr., Ph.D.       Voice:           (703) 681-2318
> >Defense Information Systems Agency      Fax:           (703)
> 681-2814
> >Information Assurance Office (JED)      DSN:
>      761
> >5600 Columbia Pike, Room 632     Voice Mail:           (703)
> 681-2318
> >Falls Church, VA 22041-2717        Internet:  <[email-masked]>
> >%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
> >
> >
> >
> >> -----Original Message-----
> >> From: Al Arsenault [SMTP:[email-masked]]
> >> Sent: Wednesday, November 18, 1998 7:47 AM
> >> To: [email-masked]
> >> Subject: Can we now kill CMMF?
> >>
> > [snip]
> >
> >> So - I suggest that we now kill the CMMF document, as it
> serves no useful
> >> purpose.

---

From: Al Arsenault <[email-masked]>
Date: Thu, 11 Feb 1999 13:20:59 -0500

Eric,

At 12:23 PM 2/11/99 -0500, Eric Bomarsi wrote:
>email thread. <snipped>
>Since then, CMP is going to RFC, CMMF seems to be

Correct.

>deficiencies, or are they competing protocols.

This is what the "PKIX Roadmap" says at this point: (text provided so that if
somebody thinks this is wrong, tell Sean & me before we release the next draft
:-)

DOCUMENT TITLE: Certificate Management Messages over CMS 
<draft-ietf-pkix-cmc-02.txt>

DESCRIPTION: This document defines the means by which PKI clients and
servers may exchange PKI messages when using S/MIME's Cryptographic
Message Syntax [CMS]as a transaction envelope.  CMC supports the certificate
request message body specified in the Certificate Request Message Format [CRMF]
documents, as well as a variety of other certificate management messages.  The
primary purpose of this specification is to allow the use of an existing
protocol (S/MIME)as a PKI management protocol, without requiring the
development of an entirely new protocol such as CMP. A secondary purpose is to
codify in IETF standards the current industry practice of using PKCS 10
messages [PKCS10] for certificate requests.  

        Yes, the two protocols (CMP and CMC) are "competing" with one another. 
CMP was created first (it evolved out of the original PKIX-3 document); then
CMC (which was originally CRS) was proposed as an alternative by a group of
people who didn't want to deal with the creation of a new protocol.  Vendors
generally choose one or the other to implement; certain vendors (I'll let them
speak for themselves) have said publically that they're going to support CMC
and never implement CMP; other vendors have made similar commitments to CMP and
seem to shun CMC.  I'm not aware of anybody who has made a public commitment to
support both, but there might be somebody.

        The decision made at the Washington IETF about 15 months ago was to go
ahead with the two different protocols at this point, and let the market decide
which one (or maybe both) would eventually win.

                                                        Al Arsenault

-- these are my opinions only. They do not necessarily reflect the 
opinions of my employer, or of any other organization with which I have a 
relationship.