Subject: PKI Resources Query Protocol

From: Massimiliano Pala <[email-masked]>
Date: Thu, 30 Jun 2005 18:42:39 +0200

Dear pkix,

I am working on the definition of a new protocol aimed to solve the problem
tied to the lack of informations about repositories and services offered
by a CSP.

One of the problems we are facing now is how to connect different
closed existing PKIs.

For this purpose I think that the availability of URI about offered services
(e.g. OCSP, SCVP, etc... ) or available data (e.g. certificate and CRLs
repositories) would help in PKI interoperability.

Therefore I am trying to work on this subject by defining a new protocol.
Reasons to adopt such a protocol are:
- extensions are too static, if new services or repositories are added
   (or dismissed) by the CSP, there is no sign of the changes into the
   already issued certificates
- no need to define new type of extensions for new services and/or
   repositories as this will be handled by the PRQP (PKI Resources Query
   Protocol)
- (practical consideration) in my experience it is easier to deal with a
   protocol than with certificate extensions (from a management and implementation
   point of view)

The protocol I am thinking about is a very lightweight (much like OCSP)
one and it is based on a request/response mechanism over HTTP.

Said this, I would really like to have your opinion on this approach, and to
know if someone is already working on a similar idea. In that case we could
collaborate on the subject and come up with a proposal for an RFC.
When I'll have something readable I will send it to the list (I know the PKIX
is going to be closed, but until that day I guess this is the best place
for this discussion... if not, just let me know).

-- 

Best Regards,

	Massimiliano Pala

--o------------------------------------------------------------------------
Massimiliano Pala [OpenCA Project Manager]      [email-masked]
                                                 Tel.:   +39 (0)11  564 7081
http://security.polito.it                       Fax:    +39   178  270 2077
                                                 Mobile: +39 (0)347 7222 365

Politecnico di Torino (EuroPKI)
Certification Authority Informations:

Authority Access Point                                  http://ca.polito.it
Authority's Certificate:          http://ca.polito.it/ca_cert/en_index.html
Certificate Revocation List:              http://ca.polito.it/crl02/crl.crl
--o------------------------------------------------------------------------