Subject: Re: draft agenda for PKIX

From: Peter Sylvester <[email-masked]>
Date: Mon, 18 Nov 2002 15:48:34 +0100 (MET)

hello,

tim polk reminded me that there is at least a fourth candidate
for the DPV/DPD solution, i.e., using RFC 3029 for DPV and DPD.
Since I am not able to present this at Atlanta, I'll do it
here, and would be happy to hear/read comments. 

here it goes:

DVCS, i.e., RFC 3029 has proposed from its very beginning a
framework allowing validation of public key certificates
in combination with its other services.

Among others the goals are to provide thin client support
and centralised management of certificate validity status.
Furthermore, in a larger view, essentially by using relaying
techniques, it is possible to implement a security infrastructure
accompagning a application work flow that used certificates.

The results of a DVCS service can be authenticated in two
ways depending on the needs of an application. Either, any
transport security mechanism allowing immediate authentication
betwwen a client server, and/or some mechanism to allow
long term validation of the result. The security mechnisms
are orthogonal to the asserted payload. For long term
authentication, a combination of offline methods and
online services are defined, i.e., a service should
provide an online validation service for its own (or
some else's) data validation certificates. 

The current text describes how to transport requests and
responses above HTTP(S), and email. 

The client has the possiblity to provide additional
information about certificate paths to the server. This
interpretation of this information, and the way how
the service is provided can be influenced by a policy
indication. 

DVCS responses can return combined information, i.e.,
assertions of validity combined with external time stamps.

As you might know, there is an ongoing open source
implementation project for RFC 3029 and 3161 financed
by the European Commission. As part of this, an
update to correct some bugs in 3029 and to describe
more usage scenarios, profiles is planned for
begging next of year.  

For the rest you may read RFC 3029. 

Well, this is my 5 minutes presentation. :-)
Regards and have fun.
Peter Sylvester

---

From: "Anders Rundgren" <[email-masked]>
Date: Mon, 18 Nov 2002 18:28:44 +0100

Another contender from another "club".

http://www.oasis-open.org/committees/dss/

If I understand the minimal description correctly, DSS seems like
a more logical next step than DPV/DPD as it addresses the
current situation where information systems do not understand
PKI at all.

cheers,
Anders

----- Original Message ----- 
From: "Peter Sylvester" <[email-masked]>
To: <[email-masked]>; <[email-masked]>
Sent: Monday, November 18, 2002 15:48
Subject: Re: draft agenda for PKIX

hello,

here it goes: