Subject: RE: Fw: The need for two grades of time data.

From: Mathew Butler <[email-masked]>
Date: Wed, 20 Sep 2000 13:38:50 -0700

Small problem here: Is PKIX not a customer of NTP, for its time information?

-Mat Butler

-----Original Message-----
From: Stephen Kent [mailto:[email-masked]]
Sent: Wednesday, September 20, 2000 12:55 PM
To: todd glassey
Cc: [email-masked]
Subject: Re: Fw: The need for two grades of time data.

Todd,

>I have to apologize because this is a philosophical retort  and I don't
mean
>to be a stick in the mud but -
>
>  >
>  > NTP is not part of the charter of this group, so this kind of topic
>  > cannot be dealt in the PKIX WG, unless the charter is changed.
>
>Denis this is just not true- the use of any protocol with PKI in it is
>germain to the Charter of this WG whether that core protocol was developed
>here or not.

Not true. S/MIME, TLS and IPsec make use of PKI, but are clearly out 
of scope. They are consumers of PKI services, just as one would 
expect NTP to be when  it makes use of PKI for authentication of its 
communication.

>Read the first sentence of the 2nd paragraph of the WG
>Description on the WG's homepage It's quoted below:
>----
>"The working group is now embarking on additional standards work to develop
>protocols that are either integral to PKI management, or that are otherwise
>closely related to PKI use."
>----
>Time and its services are clearly members of this set.

Time is covered under this when it is intrinsic to PKI management or 
use, as is the case for a time stamping protocol.  There are many 
ways for a  PKI user to acquire time for use in cert processing.

>  So then using PKI
>Authenticated NTP as a timebase for general PKIX PKI would have made a lot
>of sense. Especially  with the sheer number of places its already deployed.
>It would have given PKIX protocol's tens of  millions more seats than they
>already have, automagically.

This is pure speculation, bereft of substantiation! It ignores the 
typical reasons usually cited for reluctance by a company to 
establish a PKI.

>You know if people had to get x509 certs for
>the millions of routers they had, it would have advanced the cause of x509
>use tremendoulsy and as such our world as well.

S-BGP is another application that motivates issuance of certs to 
routers, but I don't expect it to make a dent in broader use of PKI.

Steve

---

From: "todd glassey" <[email-masked]>
Date: Wed, 20 Sep 2000 14:45:04 -0700

Mat -

1)    PKIX has no standard method of moving time around. The IETF does,
several of them - only none of them are referenced by the TSP or are used in
the TSP drafts for the synchronization of the TSA.

In fact the TSA in the TSP applies an arbitrary time instance to the stamp
that from a trust standpoint is about as reliable Carney Hucksters pitch.
There is no way in the TSP of proving anything about the Time in the Time
Stamp so then to use it, an external CPS and the associated agreements must
all be weighed to use this at any commercial level - Just doesn't make sense
to me.

2)    And what people are not realizing is that the use of NTP as a time
stamping system uses the protocol in two modes. The first is a transport for
time data, what is understood as the traditional use, and the second would
be as a transport for the audit process or TST's that get schlepped around.

The NTP solution as a carrier for the TST's themselves would invalidate the
need to build a separate protocol for this as well. Eliminates the need for
a separate level of code at the Server; and as I am so fond of saying, it
makes millions of PKI enabled systems deployable instantly. Which is
critically good for the advancement of PKI as an industry at large.

Todd
----- Original Message -----
From: "Mathew Butler" <[email-masked]>
To: "'Stephen Kent'" <[email-masked]>; "todd glassey"
<[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, September 20, 2000 1:38 PM
Subject: RE: Fw: The need for two grades of time data.

---

From: Stephen Kent <[email-masked]>
Date: Wed, 20 Sep 2000 17:06:01 -0400

Mat,

>Small problem here: Is PKIX not a customer of NTP, for its time information?

Not necessarily.  A TSA could use WWV (in the U.S.) or GPS, ACTS 
(which Todd described in a recent, Informational RFC), or some other, 
non-Internet means of acquiring time.

Steve

---

From: "todd glassey" <[email-masked]>
Date: Mon, 25 Sep 2000 12:17:07 -0700

Hi all - some minor corrections to the ACTS information.

The intent of refiling ACTS to get it into the Standards Track so that it
will proceed automatically to standard status for historical purposes. To
accomplish this the draft was re-filed in full conformance with the RFC2026
ss 10, and was done so on the STANDARDS TRACK, not the Informational one.

The ACTS protocol is in the public domain and so the standards track is the
right place for it and should proceed onward unless there are some unknown
IP rights not yet disclosed to us, but as far as I know its is free and
clear.

I have spoken with NIST and others about this and all are inline with this
creation of the "ACTS Standard" since there are now only a few million ACTS
clients distributed about the world.

Todd Glassey

---

From: "todd glassey" <[email-masked]>
Date: Mon, 25 Sep 2000 13:54:15 -0700

The intent of refiling ACTS to get it into the Standards Track so that it
will proceed automatically to standard status for historical purposes. To
accomplish this the draft was re-filed in full conformance with the RFC2026
ss 10, and was done so on the STANDARDS TRACK, not the Informational one.
I initially resubmitted the original draft and the updated one has the
correct email
and telephone contact info as well. The updated draft was sent to the
Draft's
submission email address and is now in the mill so to speak.

Todd Glassey

---

From: Stephen Kent <[email-masked]>
Date: Tue, 26 Sep 2000 17:07:19 -0400

Todd,

The suggestion that the ACTS document become a standards track, 
historical RFC seems at odds with the criteria we apply to such 
documents. For ACTS to become standards track, NIST would have to 
formally cede control to the IETF.  Also, since ACTS is not 
Internet-specific, one could question whether it belongs as an IETF 
standard at all.  I suggest you review the criteria associated with 
different categories of RFCs before proposing this change, which will 
surely be challenged.

Steve