Subject: [pkix] draft-pritikin-est-01.txt versus HTML's <keygen>

From: Anders Rundgren <[email-masked]>
Date: Wed, 18 May 2011 09:54:32 +0200

Hi Max,

What's missing in your quest is some kind of stated relation to

   http://www.w3.org/wiki/HTML/Elements/keygen

and similar stuff from other vendors.

Anders

---

From: max pritikin <[email-masked]>
Date: Wed, 18 May 2011 07:05:25 -0600

This is a good point, I should add an appendix with such discussions. 

HTML/Elements/keygen doesn't include proof-of-possession nor does it appear to mandate HTTPS. Given all the troubles in the web space regarding phishing and man-in-the-middle and spoofed urls etc this seems like a bit too simplistic. Given that I myself tend to argue toward simplicity I really appreciate this approach of paring to the bone and seeing only what must be added but I'm worried this is too simplistic. 

- max

---

From: Tomas Gustavsson <[email-masked]>
Date: Wed, 18 May 2011 15:56:43 +0200

I do believe that keygen supports proof of possession. It either 
generates the old netscape SPKAC request message, or a CRMF request 
message, both of which is self-signed by the requestor.

Cheers,
Tomas

On 05/18/2011 03:05 PM, max pritikin wrote:
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 19 May 2011 08:22:25 +0200

> This is a good point, I should add an appendix with such discussions.

Well, my point was rather that <keygen> and Microsoft's counterpart
"CertEnroll" are already implemented in maybe a billion clients.

Since you want to address all end-points you need to come up with
a scheme that makes the browser-vendors happy and united.

<snip>
Anders

---

From: Tomas Gustavsson <[email-masked]>
Date: Thu, 19 May 2011 09:23:48 +0200

On 05/19/2011 08:22 AM, Anders Rundgren wrote:
> Well, my point was rather that<keygen>  and Microsoft's counterpart

Ah, united, what a wonderful word, I believe it when I see it :-)