Subject: draft agenda for PKIX

From: Tim Polk <[email-masked]>
Date: Fri, 15 Nov 2002 14:49:57 -0500

Folks,

I have appended the *draft* agenda for the PKIX meeting on Wednesday.  I 
believe that I have included everyone who asked for time.

**Please let me know if I missed anyone.**  While the schedule is full, two 
speakers are TBDs.  If we don't have those presentations, we will have some 
free time.  (Regardless, we can probably squeeze in a short [5 min.] 
presentation or two.)

As indicated previously, the agenda is heavily weighted towards the DPD/DPV 
work.  We will try to stay on schedule, but the DPD/DPV presentations are 
first to ensure that topic is thoroughly covered.  If we run short on time, 
I will ask the later speakers with 10 minute time slots to cut to 5 
minutes!  Hopefully, that will not occur, but please consider what topics 
are most important to cover if time is short...

Please note I have included URLs for all documents, along with a few words 
(liberally edited) from each document's abstract.

Thanks,

Tim Polk

--------------------- draft agenda ----------------------

PKIX WG (pkix-wg)

WEDNESDAY, November 20 1530-1730
=================================

CHAIR: Stephen Kent <[email-masked]>, Tim Polk <[email-masked]>

AGENDA:

1. Document Status Review Tim Polk (NIST)
       The working group has twenty current Internet-Drafts.  A number of
       documents are with the ADs or in various stages of WG Last Call.
       Several others are ready for Last Call. (5 min.)

2. Delegated Path Discovery & Validation (DPD/DPV)

       The working group has completed the DPD/DPV Requirements document; this
       specification has become RFC 3379.  The requirements document was
       developed as abseline for evaluation of competing proposals.  Four
       competing protocols have been proposed; only one will be permitted to
       progress.  (10 min. each protocol, 20 min. discussion)

       2.1 Certificate Validation Protocol    Tim Polk for Denis Pinkas (Bull)
         http://www.ietf.org/internet-drafts/draft-ietf-pkix-cvp-01.txt

            CVP defines a protocol that can be used to:
              (1) query the validation or discovery policies supported by
                  a CVP server,
              (2) validate one or more public key certificates according to a
                  single validation policy, or
              (3) obtain one or more certification paths for one or more
                  certificates according to a single discovery policy.

       2.2 Simple Certificate Validation Protocol           Russ Housley (RSA)
                                     Ambarish Malpani (Independent Consultant)

          http://www.ietf.org/internet-drafts/draft-ietf-pkix-scvp-10.txt

           SCVP allows a client to offload certificate handling to a 
server. The
           server can prove the client with a variety of valuable information
           about the certificate, such as whether the certificate is valid, a
           certification path to a trust anchor, and so on.

       2.3 Data Validation and Certification Server Protocols TBD

         http://www.ietf.org/rfc/rfc3029.txt

            Useful Data Validation and Certification Server 
responsibilities in a
            PKI are to assert the validity of signed documents, public key
            certificates, and the possession or existence of data.

       2.4 DPD/DPV using OCSP with extensions   Mike Myers (Lockheed Martin)

          To be submitted.

            OCSP is a protocol useful in determining the current status of a
            digital certificate without requiring CRLs.  A supplemental draft
            for DPV using OCSP have been previously submitted; this content and
            OCSPv2 (see below) jointly form the basis for this DPD/DPV 
proposal.

       2.5 Open Mike Discussion DPD/DPV Protocols  [15 min.]

       2.6 Selection Strategy & Timeline (Chairs)  [5 min.]

          As noted above, only one protocol may progress.  Selecting the 
"winner"
          should be achieved at the earliest possible date, to speed 
completion and
          permit readers to concentrate engineering effort on the final 
protocol.

3. Proxy Certificate Profile - Von Welch (Univ. of Chicago)

       http://www.ietf.org/internet-drafts/draft-ietf-pkix-proxy-03.txt

       Use of a proxy credential for impersonation is a common technique 
used in
       security systems, allowing an entity A to grant to another entity B the
       right for B to authenticate with others as if it were A.  This document
       defines a certificate profile for proxy credentials based on RFC 3280.
       (10 min.)

4. An LDAPv3 Schema for X.509 Certificates - Peter Gietz (DAASI)

       http://www.directory.dfn.de/docs/draft-klasen-ldap-x509certificate-sc 
http://www.directory.dfn.de/docs/draft-klasen-ldap-x509certificate-schema-01 
.txt

       This personal draft describes an LDAPv3 schema which can be used to 
implement
       a certificate store for X.509 certificates. (10 min.)

5. Attribute Certificate Policy extension - TBD

       http://www.ietf.org/internet-drafts/draft-ietf-pkix-acpolicies-extn-0 
http://www.ietf.org/internet-drafts/draft-ietf-pkix-acpolicies-extn-01.txt

       This document defines an attribute certificate policy extension, 
which is an
       analog to the certificate policies extension for public key 
certificates.  This
       extension can be used to assert the policy governing issuance of the 
attribute
       certificate in which it appears. (10 min.)

6.  Online Certificate Status Protocol v2   Mike Myers (Lockheed Martin)

       http://www.ietf.org/internet-drafts/draft-ietf-pkix-ocspv2-ext-00.txt

       OCSP is a protocol useful in determining the current status of a
       digital certificate without requiring CRLs.   OCSP Version 1 is defined
       in RFC 2560.  This document specifies OCSPv2, which provides additional
       mechanisms for specifying the certificate for which the revocation 
status
       is requested. (10 min.)

7.  RFC 3280 Interoperability Testing Report - Tim Polk (NIST)

       NIST is currently performing the interoperability testing for RFC 
3280.  This
       presentation will update the WG on NIST's progress, projected 
completion date,
       and issues identified to date.  (5 min.)

8.  Subscriber Identification Method - Park Jong-Wook (KISA)

       http://www.ietf.org/internet-drafts/draft-ietf-pkix-sim-00.txt

       This new draft attempts to resolve situations where one entity holds 
multiple
       certificates with different subject names. (5 min.)

9. JNSA Challenge PKI 2002 - Ryu Inada (JNSA)

       The Japan Network Security Association is conducting JNSA Challenge 
PKI 2002.
       This is work in progress, and presents an approach towards 
implementing a
       Multi-Domain PKI Test Suite.  The JNSA reports will be available in 
English in
       the future; this presentation provides an interim update on JNSA's 
progress.
       (5 min.)