Subject: policy oid registration, and handling

From: "Peter Williams" <[email-masked]>
Date: Fri, 2 Apr 1999 11:59:01 -0600

"MISPC Reference Implementation (T. Polk-NIST)
CDROM contains CA, RA, and client executable code. Represents a profile of
2459, CMP, and CRMF. Available via web site: http://crscnist.gov/pki/mispc/"

A. MISPC

Can PKIX assign a cert-policy oid for this "MISPC" profile of RFC 2459,
which is a profile of X.509 (1997). It is not a PKIX WG
sponsored process, and does not meet spirit of IETF openness
to individuals, but MISPC was  a public-spirited  effort designed to
spur this industry on. It is generally recognised as meaningfull.

B. PKIX-QC OID

We agreed to assign a cert-policy oid for the PKIX-QC profile of
RFC 2459, in the last meeting, note. Can we assign an oid,
so implementations today can code for it, in their profile
management dll-switching code? (Note X.509 v3 did prior
assignment of extension oids, to help implementors, so there
is clear and relevant precedent.)

C. Registration Procedures

Should  procedure be created to enable any party to
use the pkix arc to register a profile of 2459, providing it meets
requirements such as posting of the specification
as an RFC (as with the PEM PCA rules)?

D. NIST Registration

I note NIST is also running an policy-id object id arc, figuratively
on behalf of ITU-T. Should PKIX-1 compliance require
folks to recognise this arc as authoritative, in a spur
towards making PKIX more real?

This NIST security objects register has very formal
and due process-oriented procedures for object (policy id) registration.
It could complement the less formal Internet decision procedures used
by IETF, and Russ (as the PKIX arc registrar).

E. Individual-Centric Registration

We need a mechanism whereby "individuals" can register and thereby share
policy oids in the devolved extensibility and user experimentation framework
which IETF and Internet culture normally promotes in its Internet standards.
Just as folk can register (informally these days) mime types, so
they should be able to register/obtain policy oids which are 2459 profiles.

Peter.

---

From: Michael Sierchio <[email-masked]>
Date: Fri, 02 Apr 1999 16:46:53 -0800

> 2459, CMP, and CRMF. Available via web site: http://crscnist.gov/pki/mispc/"

http://csrc.nist.gov/pki/mispc/

Minimum Interoperability   
Specifications for PKI Components
Cooperative Research and Development: Implementing an Interoperable PKI

NIST developed the Minimum Interoperability Specifications for PKI
Components (MISPC), Version 1 with the assistance of ten CRADA
partners:  AT&T, BBN, Certicom, Cylink, DynCorp, IRE, Motorola,
Nortel (Entrust), Spyrus, and Verisign. The specification includes
a certificate and CRL profile, message formats and basic transactions
for a PKI issuing signature certificates. The specification includes
support for multiple signature algorithms and transactions to 
support a broad range of security policies. This document has been
formally published as a NIST Special Publication 800-15; it is
available electronically in Microsoft Word (284K) or PostScript
(954K).