Subject: Re: Lightweight Certificate Validation Protocol (LCVP)

From: "Denis Pinkas" <[email-masked]>
Date: Thu, 3 May 2007 15:52:47 +0200

Paul and Stefan,

>At 9:23 AM +0100 5/2/07, Stefan Santesson wrote:
>>Your job is to convince the WG that there is substantial reason to 
>>work on your draft. So far you have not been successful.
>>
>>I can only offer you honestly what I personally need to be 
>>convinced. In this case I will mostly not be convinced by technical 
>>arguments listing all things you can do with your protocol. To 
>>convince me you need to demonstrate the need in the industry and 
>>also convince me that the negative impact on the industry by adding 
>>another protocol, is less than the benefits.
>>
>>That consideration is valid for IETF in its mission to make the 
>>internet better and therefore also for this WG.
>>
>>However I'm not telling you what to do and I am not the WG. As chair 
>>I do determine consensus but I'm only 1 voice.
>
>Let me add a second voice, agreeing with Stefan. From this thread, I 
>see that your proposal is close to SCVP in functionality with some 
>differences he considers important. Others have said that most of the 
>differences you gave are already in SCVP.
>
>If there is a large industry segment who need your differences, we 
>might consider it for WG action. Otherwise, this should be an 
>individual contribution with its own mailing list and occasional 
>pointers here to the new drafts.

Maybe you could help me, by describing before "the large industry segment"
that has already implemented or is currently implementing the whole content of SCVP.

If this market segment is not large but small, maybe you could indicate 
which parts of SCVP have been or are being implemented.

Thenafter, I might be able to tell you, in my opinion, what is the market segment for LCVP.  

Denis

>--Paul Hoffman, Director
>--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 3 May 2007 07:22:42 -0700

>that has already implemented or is currently implementing the whole 

You misunderstood my message (or you are being purposely nasty; I 
hope the former). We have a standard today that is beginning to be 
implemented. You are proposing that the WG start work on a second 
standard that is like the first one with a few differences. It is 
your responsibility to show the WG why they should spend their time 
on this, given the similarity. If there is a large industry segment 
who needs your proposal, it would help the WG choose in your favor.

>which parts of SCVP have been or are being implemented.

I know of at least two vendors who are implementing all of SCVP; they 
may or may not choose to speak up on the list.

>Thenafter, I might be able to tell you, in my opinion, what is the 

If you have no idea what the market for LCVP is, please don't waste 
our time with it.

--Paul Hoffman, Director
--VPN Consortium

---

From: Stephen Kent <[email-masked]>
Date: Tue, 8 May 2007 09:07:50 -0400

At 3:52 PM +0200 5/3/07, Denis Pinkas wrote:
>...

Denis,

I've been on vacation for 2 weeks, so I am catching up on this 
thread. However, let me note that he criteria for deciding whether 
PKIX should consider LCVP as a WG item is very different from the 
criteria associated with proceeding with SCVP.

As you well know, SCVP has gone through a long evolution; we started 
with a contentious requirements development process in which you 
played a major role.  We then asked the proponents of the 4 candidate 
protocols to analyze their proposals against the agreed upon 
requirements.  Finally, we conducted a straw poll i which SCVP 
emerged as the winner. Then we revised SCVP many times as a few 
folks, especially you, identified issues that had not come up during 
the previous reviews.  Based on al of this collaborative effort, SCVP 
is the WG choice.

The IETF encourages WGs to not offer several standards with more or 
less equivalent functionality, which implies that we ought not adopt 
as a WG item a protocol that is close to SCVP in most respects.  Thus 
the onus is on you, as the proponent for LCVP, to convince the WG 
that it merits consideration.

I agree with Stefan and Paul that, so far, you have not done so.

Steve

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 9 May 2007 09:00:50 -0700

I see no value in LCVP. It adds nothing that is not already done better and more simply in XKMS. If you want lightweight you need to rethink the whole architecture.

You cannot reduce the complexity of PKI beyond the complexity of the world it describes. The only choices you can make are to avoid adding additional complexity and chose where you put the complexity.

The complexity of PKIX is due to the fact that it is the product of a twenty year evolution. In particular it is the result of a series of incremental additions. Certificates, CRLs, OCSP, SCVP, PKCS#7 all use different structures, processing rules, semantics because they were developed at different times. It is entirely possible to use one format for all of them, this is what the SAML assertion structure was originally designed to do.

Adding another format to the mix adds complexity, it does not simplify.

Either you start from a clean sheet of paper *AND WORKING GROUP* and accept that you will lose the deployed base or you respect the deployed base and work within its constraints. There is no middle way.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stephen Kent
> Sent: Tuesday, May 08, 2007 9:08 AM
> To: Denis Pinkas
> Cc: Paul Hoffman; Stefan Santesson ; pkix
> Subject: Re: Lightweight Certificate Validation Protocol (LCVP)
> 
> 
> I've been on vacation for 2 weeks, so I am catching up on 
> this thread. However, let me note that he criteria for 
> deciding whether PKIX should consider LCVP as a WG item is 
> very different from the criteria associated with proceeding with SCVP.
> 
> As you well know, SCVP has gone through a long evolution; we 
> started with a contentious requirements development process 
> in which you played a major role.  We then asked the 
> proponents of the 4 candidate protocols to analyze their 
> proposals against the agreed upon requirements.  Finally, we 
> conducted a straw poll i which SCVP emerged as the winner. 
> Then we revised SCVP many times as a few folks, especially 
> you, identified issues that had not come up during the 
> previous reviews.  Based on al of this collaborative effort, 
> SCVP is the WG choice.
> 
> The IETF encourages WGs to not offer several standards with 
> more or less equivalent functionality, which implies that we 
> ought not adopt as a WG item a protocol that is close to SCVP 
> in most respects.  Thus the onus is on you, as the proponent 
> for LCVP, to convince the WG that it merits consideration.
>