Subject: Re: [pkix] Proposal for a new Working Item: PKIX API

From: Stefan Santesson <[email-masked]>
Date: Fri, 08 Oct 2010 14:32:13 +0200

Max,

I have some questions and concerns about a PKIX API.

My experience from Crypto APIs is that you often can use them from may OS
environments. My experience is primary with Java but if I write some code
using an API in UNIX/OS X then I can mostly use the same code and same API
in e.g. Windows.

This is of course not the case with CAPI but I have done it with OpenSSL and
CryptLib.

The second issue/question is with the ambition to make it simple.
In most of my cases simple means I can't use it. 99% of my issues can be
solved by simple APLI calls, but there are often the case where the last 1%
can't, rendering the whole API useless for that application.

Could you provide some more down to the earth use cases where a developer
would substantially benefit from this API?

That might help to narrow down its scope and determine its usability.

/Stefan 

On 10-09-24 10:59 PM, "Massimiliano Pala" <[email-masked]>
wrote:

> Hi Patrick,
> 
> I agree with your point. I also think that many problem arise by the excess of
> flexibility we have in crypto API. Many times, the functionality we need are
> few, and we end up using the same list of calls to do the same tasks. Having
> an high-level API would help the developer to do the right thing (e.g., right
> initialization for key generation or path-building/path-validation).
> 
> This will not solve the problem related to the lack of any knowledge about
> the technology, but would help the developers to deal with the details which,
> in PKIs, are really important to get things right.
> 
> It is just one step.. but I think that we have to start somewhere.. :D
> 
> Cheers,
> Max
> 
> 
> On 09/24/2010 07:18 PM, Patrick Patterson wrote:
> [...]
>> I sort of have a problem with this - a week or two on the OpenSSL mailing
>> list will
>> demonstrate that "unskilled developers" don't need help with an API.  What
>> they need
>> help with are the basic concepts and practices around doing PKI [1]. Until we
>> figure
>> out a way to make THAT happen, developing a simplified, portable API isn't
>> going to
>> help - that will just let people develop PORTABLE applications that don't do
>> PKI in
>> even close to a sane or standards compliant way.
> 
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix