Subject: "final" PKIX agenda for Atlanta

From: [email-masked]
Date: Mon, 18 Nov 2002 16:11:17 -0500

Folks,

I have appended the "final" agenda for the PKIX WG.  The following changes have 
been made:

(1) Peter Sylvester's DVCS presentation was deleted.  The presentation was made 
onlist, as he will not be in Atlanta.  (See email earlier today.)

(2) Christopher Francis has confirmed to present the Attribute Certificate 
Policies draft.

(3) Alice Sturgeon's presentation on Warranty Extension has been added as #6.

Thanks,

Tim Polk

-------------- PKIX Agenda, 55th IETF Meeting ---------------

PKIX WG (pkix-wg)

WEDNESDAY, November 20 1530-1730
=================================

CHAIR: Stephen Kent <[email-masked]>, Tim Polk <[email-masked]>

AGENDA:

1. Document Status Review Tim Polk (NIST)
      The working group has twenty current Internet-Drafts.  A number of 
      documents are with the ADs or in various stages of WG Last Call.
      Several others are ready for Last Call. (5 min.)

2. Delegated Path Discovery & Validation (DPD/DPV)

      The working group has completed the DPD/DPV Requirements document; this
      specification has become RFC 3379.  The requirements document was
      developed as abseline for evaluation of competing proposals.  Four
      competing protocols have been proposed; only one will be permitted to
      progress.  (10 min. each protocol, 20 min. discussion)

      2.1 Certificate Validation Protocol    Tim Polk for Denis Pinkas (Bull)
        http://www.ietf.org/internet-drafts/draft-ietf-pkix-cvp-01.txt

           CVP defines a protocol that can be used to:
             (1) query the validation or discovery policies supported by 
                 a CVP server, 
             (2) validate one or more public key certificates according to a 
                 single validation policy, or
             (3) obtain one or more certification paths for one or more
                 certificates according to a single discovery policy.

      2.2 Simple Certificate Validation Protocol           Russ Housley (RSA)
                                    Ambarish Malpani (Independent Consultant)

         http://www.ietf.org/internet-drafts/draft-ietf-pkix-scvp-10.txt

          SCVP allows a client to offload certificate handling to a server. The
          server can prove the client with a variety of valuable information
          about the certificate, such as whether the certificate is valid, a
          certification path to a trust anchor, and so on. 

      2.3 DPD/DPV using OCSP with extensions   Mike Myers (Lockheed Martin)

         To be submitted.
         
           OCSP is a protocol useful in determining the current status of a 
           digital certificate without requiring CRLs.  A supplemental draft
           for DPV using OCSP have been previously submitted; this content and
           OCSPv2 (see below) jointly form the basis for this DPD/DPV 
proposal.         

      2.4 Open Mike Discussion DPD/DPV Protocols  [15 min.]

      2.5 Selection Strategy & Timeline (Chairs)  [5 min.]

         As noted above, only one protocol may progress.  Selecting the "winner"
         should be achieved at the earliest possible date, to speed completion 
and 
         permit readers to concentrate engineering effort on the final protocol.

3. Proxy Certificate Profile - Von Welch (Univ. of Chicago)

      http://www.ietf.org/internet-drafts/draft-ietf-pkix-proxy-03.txt

      Use of a proxy credential for impersonation is a common technique used in
      security systems, allowing an entity A to grant to another entity B the
      right for B to authenticate with others as if it were A.  This document
      defines a certificate profile for proxy credentials based on RFC 3280.
      (10 min.)

4. An LDAPv3 Schema for X.509 Certificates - Peter Gietz (DAASI) 

      http://www.directory.dfn.de/docs/draft-klasen-ldap-x509certificate-schema-
01.txt

      This personal draft describes an LDAPv3 schema which can be used to 
implement
      a certificate store for X.509 certificates. (10 min.)

5. Attribute Certificate Policy extension - Christopher Francis (WetStone)

      http://www.ietf.org/internet-drafts/draft-ietf-pkix-acpolicies-extn-01.txt

      This document defines an attribute certificate policy extension, which is 
an
      analog to the certificate policies extension for public key 
certificates.  This
      extension can be used to assert the policy governing issuance of the 
attribute
      certificate in which it appears. (10 min.)

6. Warranty Extension - Alice Sturgeon (Spyrus)

      http://www.ietf.org/internet-drafts/draft-ietf-pkix-warranty-extn-01.txt

      This document describes a certificate extension to explicitly state
      the warranty offered by a Certificate Authority (CA) for a the
      certificate containing the extension. (10 min.)

7. Online Certificate Status Protocol v2   Mike Myers (Lockheed Martin)

      http://www.ietf.org/internet-drafts/draft-ietf-pkix-ocspv2-ext-00.txt
         
      OCSP is a protocol useful in determining the current status of a 
      digital certificate without requiring CRLs.   OCSP Version 1 is defined
      in RFC 2560.  This document specifies OCSPv2, which provides additional
      mechanisms for specifying the certificate for which the revocation status
      is requested. (10 min.)

7.  RFC 3280 Interoperability Testing Report - Tim Polk (NIST)

      NIST is currently performing the interoperability testing for RFC 3280.  
This
      presentation will update the WG on NIST's progress, projected completion 
date,
      and issues identified to date.  (5 min.)

8.  Subscriber Identification Method - Park Jong-Wook (KISA)

      http://www.ietf.org/internet-drafts/draft-ietf-pkix-sim-00.txt

      This new draft attempts to resolve situations where one entity holds 
multiple
      certificates with different subject names. (5 min.)

9. JNSA Challenge PKI 2002 - Ryu Inada (JNSA)

      The Japan Network Security Association is conducting JNSA Challenge PKI 
2002.
      This is work in progress, and presents an approach towards implementing a
      Multi-Domain PKI Test Suite.  The JNSA reports will be available in 
English in
      the future; this presentation provides an interim update on JNSA's 
progress.
      (5 min.)