Subject: [pkix] SCEP vs CMC vs CMP

From: "Alper Yegin" <[email-masked]>
Date: Thu, 28 Oct 2010 11:01:51 +0300

Hello,

There appears to be multiple solutions for enrolling X.509 certificates.

RFC 5272

RFC 4210

draft-nourse-scep

Does anyone care to comment on how a vendor/operator/SDO should decide which
one to go with?

Thanks.

Alper

---

From: "Miller, Timothy J." <[email-masked]>
Date: Thu, 28 Oct 2010 08:55:10 -0400

Punt?  ;)

Thou reopenest old wounds.  Break out the asbestos blankets!

All kidding aside, on the operational side practical matters will dominate.  Typically this means the enrollment protocols used by your dominant platform will drive your decisions.  This will basically force you into proprietary solutions (SCEP, Microsoft's protocol-du-jour, &tc.), which in turn will drive requirements for selecting CA services & products.

-- Tim

________________________________
From: [email-masked] [[email-masked]] On Behalf Of Alper Yegin [[email-masked]]
Sent: Thursday, October 28, 2010 3:01 AM
To: [email-masked]
Subject: [pkix] SCEP vs CMC vs CMP

Hello,

RFC 5272
RFC 4210
draft-nourse-scep

Does anyone care to comment on how a vendor/operator/SDO should decide which one to go with?

Thanks.

Alper

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 28 Oct 2010 16:02:32 +0200

> Does anyone care to comment on how a vendor/operator/SDO should decide 

Elaborating a bit on Timothy's answer....

I think this depends on the application(s) using certificates.

For routers and similar SCEP is a de-facto standard.

For smart card provisioning CMP is quite popular although in reality
the actual X.509 part is just one of a multitude of things you need
to do in such scenarios.

For browser-based "soft" keys, there are entirely different and generally
inferior schemes such as Microsoft's CertEnroll and Mozilla's <keygen>.
Most serious deployments of such PKIs have therefore been forced creating
their own (proprietary) enrollment software although the core PKI message
typically is based on PKCS #10.

Thanx,
Anders

> 
>  
> 
> Thanks.
> 
>  
> 
> Alper
> 
>  
> 
>  
> 
>  
> 
>  
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: "Alper Yegin" <[email-masked]>
Date: Thu, 28 Oct 2010 18:27:01 +0300

Thank you for the answers.
Sorry, I didn't mean to reopen wounds :-)

To be more specific, we are looking for ways to enroll X.509 certificates on
mobile terminals to be used for WiFi network access authentication.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Anders Rundgren
> Sent: Thursday, October 28, 2010 5:03 PM
> To: [email-masked]
> Subject: Re: [pkix] SCEP vs CMC vs CMP
> 
> Alper Yegin wrote:
> >
> > Does anyone care to comment on how a vendor/operator/SDO should
> decide
> > which one to go with?
>

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 28 Oct 2010 08:32:04 -0700

>mobile terminals to be used for WiFi network access authentication.

SCEP is not your answer. It is narrowly limited to IPsec VPN boxes, and a small subset of that market.

That's one less wound to open, but the CMC and CMP wounds are still oozing plenty of (graphic elaboration elided...)

---

From: Russ Housley <[email-masked]>
Date: Thu, 28 Oct 2010 13:03:29 -0400

> Does anyone care to comment on how a vendor/operator/SDO should decide

Alper:

We would have only one specification if there was consensus on an answer
to your question.

Russ

---

From: "Miller, Timothy J." <[email-masked]>
Date: Thu, 28 Oct 2010 14:52:30 -0400

Never overlook the utility of doing things by hand.

With so-called manual device enrollment, you may be able to maintain your PKI's assurance level more simply because your RAs can ensure the claimed device identity is correct during the enrollment ceremony.  This is much harder to do remotely or with an automated process, and therefore more expensive.  Where the trade-off occurs depends on your scale.

-- Tim

________________________________
From: Alper Yegin [[email-masked]]
Sent: Thursday, October 28, 2010 10:27 AM
To: 'Anders Rundgren'; [email-masked]; Miller, Timothy J.
Subject: RE: [pkix] SCEP vs CMC vs CMP

Alper

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 28 Oct 2010 21:15:51 +0200

> Never overlook the utility of doing things by hand.

Yes, PKCS #12 import seems to be the common denominator for the
use-case you mention.

> With so-called manual device enrollment, you may be able to maintain 
> your PKI's assurance level more simply because your RAs can ensure the 
> claimed device identity is correct during the enrollment ceremony.  This 
> is much harder to do remotely or with an automated process, and 
> therefore more expensive.  Where the trade-off occurs depends on your scale.

Well, device identity *could* be as secure as anything else but unfortunately
it is currently not.

Based on the lack of action, I believe the US device vendors want us to use our
MSN-Live, Google, or Itunes login rather than toil with stupidities like PKI :-)

Late-breaking news: Maybe Apple will surprise us all (again)!

http://gigaom.com/2010/10/27/is-apple-about-to-cut-out-the-carriers/

Anders

> *From:* Alper Yegin [[email-masked]]
> *Sent:* Thursday, October 28, 2010 10:27 AM
> *To:* 'Anders Rundgren'; [email-masked]; Miller, Timothy J.
> *Subject:* RE: [pkix] SCEP vs CMC vs CMP
>