Subject: [pkix] SCEP or not to SCEP ? (was Re: Certificate enrollment at Beijing IETF?)

From: Massimiliano Pala <[email-masked]>
Date: Fri, 05 Nov 2010 11:10:17 -0400

On 11/05/2010 07:53 AM, Peter Gutmann wrote:
[...]
> But we already have something like this in CMP, this is why CRMF is done as a

Yep, that is why I said "let's check what we can save of CMP/CMC". Maybe
we can change the CMP approach to make it easier to achieve interoperability
now that we know that that approach did not really work..

[..]
> octopi" (which is what "IMHO" really stands for) and then set the NR bit in
> the keyUsage flags).

Hehehhe.. really nice acronym :D I would say that is an interesting point, it
could be part of the protocol to allow for field checking although.. that would
be technically very hard to enforce because of the flexibility of certificates
(too many options where to put stuff in).

I would say that, for this issue, we will still have to rely on:
- CP/CPS
- certificate usage agreement

After all, the CA is responsible for the information they put in a certificate
and, AFAIK, liable for it since it is a "public" piece of information...

> So if you want this facility, use CMP or CMC.  We already have the
> antipatterns, what we need is the patterns :-).

Of course, Peter, that is just a proposal that I think it might be really
useful. Should the WG decide to go for just an updated version of SCEP, it
if fine with me (better something than nothing).

My only fear is that we'll end up using extensions in the cert request that
are not standardized... :D Easier for me as a developer, but harder to achieve
interoperability, which is the whole point of Open Standards :D

Cheers,
Max