Subject: [Wijnen, Bert (Bert)] FW: [members] FW: Proposed charter for OASIS EKMI TC

From: Sam Hartman <[email-masked]>
Date: Tue, 14 Nov 2006 08:49:59 -0500

I'm sorry if this has already been forwarded to pkix.

Subject: FW: [members] FW: Proposed charter for OASIS EKMI TC
From: "Wijnen, Bert (Bert)" <[email-masked]>
To: "Russ Housley (E-mail)" <[email-masked]>, "Sam Hartman (E-mail)" <[email-masked]>
Cc: "Iesg (E-mail)" <[email-masked]>, "IAB (E-mail)" <[email-masked]>
Date: Mon, 13 Nov 2006 15:36:49 +0100

FYI, just in case no one else sees these types of
announcements.

Loa, are these guys on the new-work list?
If not, maybe you should contact them to see if they
are willing to announce these things on new-work as well.

Bert

-----Original Message-----
From: Mary McRae [mailto:[email-masked]]
Sent: Friday, November 10, 2006 18:57
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: [members] FW: Proposed charter for OASIS EKMI TC 

To: OASIS Members 

   A draft TC charter has been submitted to establish an Enterprise
Key Management Infrastructure (EKMI) Technical Committee at OASIS.
We circulate such draft charters for member review and comments, in
accordance with Section 2,2 of the OASIS TC Process rules: 
   http://www.oasis-open.org/committees/process.php#2.2
The proposed charter below is open for comment. The comment period
shall remain open until 11:45 pm ET on 22 November 2006. 

   OASIS maintains a mailing list for the purpose of submitting
comments on proposed charters. Any OASIS member may post to this
list by sending e-mail to:
   [email-masked].
All messages will be publicly archived at:
   http://lists.oasis-open.org/archives/oasis-charter-discuss/  

Members who wish to receive these messages via e-mail must join the
group by selecting "join group" on the list's home page:

http://www.oasis-open.org/apps/org/workgroup/oasis-charter-discuss/.
Employees of organizational members do not require primary
representative approval to subscribe to the oasis-charter-discuss
e-mail.

   A telephone conference will be held among the Convener, the OASIS TC
Administrator, and those proposers who wish to attend shortly after
  the close of the comment period.  The time and call-in information
will be noted on the oasis-charter-discuss list and home page. 

   We encourage member comment, and ask that you note the name of
the proposed TC (EKMI) in the subject line of your email message.

   Best regards   JBC

~ James Bryce Clark
~ Director of Standards Development, OASIS 
~ http://www.oasis-open.org/who/staff.php#clark
~ [email-masked]

====
PROPOSED CHARTER 
FOR REVIEW AND COMMENT
OASIS ENTERPRISE KEY MANAGEMENT INFRASTRUCTURE TECHNICAL COMMITTEE

Name

OASIS Enterprise Key Management Infrastructure (EKMI) TC

Statement of Purpose

Public Key Infrastructure (PKI) technology has been around for more 
than a decade, and many companies have adopted it to solve specific
problems in the area of public-key cryptography.  Public-key
cryptography has been embedded in some of the most popular tools --
web clients and servers, VPN clients and servers, mail user agents, 
office productivity tools and many industry-specific applications --
and underlies many mission-critical environments today.
Additionally, there are many commercial and open-source
implementations of PKI software products available in the market 
today.  However, many companies across the world have recognized
that PKI by itself, is not a solution.

There is also the perception that most standards in PKI have already
been established by ISO and the PKIX (IETF), and most companies are 
in operations-mode with their PKIs -- just using it, and adopting it
to other business uses within their organizations. Consequently,
there is not much left to architect and design in the PKI community.

Simultaneously, there is a new interest on the part of many 
companies in the management of symmetric keys used for encrypting
sensitive data in their computing infrastructure. While symmetric
keys have been traditionally managed by applications doing their own
encryption and decryption, there is no architecture or protocol that 
provides for symmetric key management services across applications,
operating systems, databases, etc. While there are many industry
standards around protocols for the life-cycle management of
asymmetric (or public/private) keys -- PKCS10, PKCS7, CRMF, CMS, etc. 
-- however, there is no standard that describes how applications may
request similar life-cycle services for symmetric keys, from a
server and how public-key cryptography may be used to provide such
services. 

Key management needs to be addressed by enterprises in its
entirety -- for both symmetric and asymmetric keys.  While each type
of technology will require specific protocols, controls and
management disciplines, there is sufficient common ground in the 
discipline justifying the approach to look at key-management as a
whole, rather than in parts.  Therefore, this TC will address the
following:

Scope

A) The TC will define the request/response protocols for: 

1. Requesting a new or existing symmetric key from a server;
2. Requesting policy information from a server related to caching of
keys on the client;
3. Sending a symmetric key to a requestor, based on a request; 
4. Sending policy information to a requestor, based on a request;
5. Other protocol pairs as deemed necessary.

B) To ensure cross-implementation interoperability, the TC will
create a test suite (as described under 'Deliverables' below) that 
will allow different implementations of this protocol to be
certified against the OASIS standard (when ratified);

C) The TC will provide guidance on how a symmetric key-management
infrastructure may be secured using asymmetric keys, using secure 
and generally accepted practices;

D) Where appropriate, and if possible in conjunction with other
standards organizations that focus on disciplines
outside the purview of OASIS, the TC will provide input on how such 
enterprise key-management infrastructures may be managed, operated
and audited;

E) The TC may conduct other activities that educate users about,
and promote, securing sensitive data with appropriate cryptography, 
and the use of proper key-management techniques and disciplines to
ensure appropriate protection of the infrastructure.

List of Deliverables

1. XSchema Definitions (XSD) of the request and response protocols 
(by April 2007)
2. A Test Suite of conformance clauses and sample transmitted keys
and content that allows for clients and servers to be tested for
conformance to the defined protocol (by September 2007)
3. Documentation that explains the communication protocol (by 
April 2007)
4. Documentation that provides guidelines for how an EKMI may be
built, operated, secured and audited (by June 2007)
5. Resources that promote enterprise-level key-management: white
papers, seminars, samples, and information for developer and public 
use. (beginning January 2007, continuing at least through 2008)

Anticipated Audiences:

Any company or organization that has a need for managing
cryptographic keys across applications, databases, operating systems 
and devices, yet desires centralized policy-driven management of all
cryptographic keys in the enterprise. Retail, health-care,
government, education, finance - every industry has a need to
protect the confidentiality of sensitive data. The TC's 
deliverables will provide an industry standard for protecting
sensitive information across these, and other, industries.
Security services vendors and integrators should be able to fulfill
their use cases with the TC's key management methodologies. 
Members of the OASIS PKI TC should be very interested in this new TC,
since the goals of this TC potentially may fulfill some of the
goals in the charter of the PKI TC.

Language:

English

IPR Policy: 

Royalty Free on Limited Terms under the OASIS IPR Policy

----
Additional Non-normative information regarding the start-up of the TC:

a. Identification of similar or applicable work:

The proposers are unaware of any similar work being carried on in 
this exact area.  However, this TC intends to leverage the
products of, and seek liaison with, a number of other existing
projects that may interoperate with or provide functionality to the
EKMI TC's planned outputs, including: 

OASIS Web Services Security TC
W3C XMLSignature and XMLEncryption protocols and working group
OASIS Digital Signature Services TC
OASIS Public Key Infrastructure TC
OASIS XACML TC (and other methods for providing granular 
access-control permissions that may be consumed or enforced by
symmetic key management)

b.  Anticipated contributions:

StrongAuth, Inc. anticipates providing a draft proposal for the EKMI
protocol, at the inception of the TC.  The current draft can be 
viewed at:

http://www.strongkey.org/resources/documentation/misc/skcl-sks-protocol.html
and a working implementation of this protocol is available at: 
   http://sourceforge.net/projects/strongkey for interested parties.

c. Proposed working title and acronym for specification:

Symmetric Key Services Markup Language (SKSML), subject to TC's 
approval or change.

d.  Date, time, and location of the first meeting:

First meeting will be by teleconference, with an optional face-to-
face gathering as one conference call node, at:
Date:  [December ____, 2006] 
Time:  [____ UTC]
Call in details'; to be posted to TC list
F2F Location:  San Francisco Bay Area.  StrongAuth has agreed to
host this meeting.

e. Projected meeting schedule:

Subject to TC's approval, we anticipate monthly telephone meetings 
for the first year. First version of the protocol to be voted on by
Summer 2007. StrongAuth is willing to assist by arranging for the
teleconferences; we anticipate using readily available free
teleconference services. 

f. Names, electronic mail addresses, of supporters:

Ken Adler, individual member, [email-masked]
June Leung, FundSERV, [email-masked] 
John Messing, American Bar Association, [email-masked]
Arshad Noor, individual member, [email-masked] 
Davi Ottenheimer, individual member, [email-masked]
Ann Terwilliger, Visa International, [email-masked]

g. TC Convener:

Arshad Noor, [email-masked]

END DRAFT

-- 
Mary P McRae
Manager of TC Administration, OASIS
[email-masked]
voip: 603.232.9090

Message does not appear in the archives - forwarding for inclusion

---------------------------------------------------------------------

This email list is used solely by OASIS for official consortium communications.

Opt-out requests may be sent to [email-masked], however, all members are strongly encouraged to maintain a subscription to this list.