Subject: [pkix] Token Provisioning versus Certificate Enrollment

From: Anders Rundgren <[email-masked]>
Date: Thu, 25 Aug 2011 22:05:17 +0200

With a hope to shed some light regarding enrollment protocols the following may be of some interest.

KeyGen2 is /_not_/ a Certificate Enrollment protocol; /it is a Token (cryptographic module) Provisioning protocol/.

Unlike Certificate Enrollment which essentially only requires a request-response pair where the response (certificate) can be securely derived to request, /Token Provisioning usually needs additional
steps /_before_/and _after_ the core message exchange as well/.

Also in contrast to Certificate Enrollment protocols, /Token Provisioning _always_ targets a specific token container/.
If /_secure_/ Token Provisioning is to be performed by remote users over the Internet, /E2ES (end-to-end-security) _must be enforced_, and preferably throughout the _entire_ process/.

Since E2ES cannot be /abstracted/, a prerequisite is that /the issuer and token _speak the same language_/.
This obviously thickens the plot considerably unless you also standardize the token (/with respect to provisioning NB/), which was the sole motivation behind KeyGen2's alter ago, the SKS.

KeyGen2/SKS in similarity to GlobalPlatform relies on a very light-weight security mechanism based on session keys and a two-level client where the provisioning middleware does the /"heavy lifting"/
and handle /user interactions/, while /the token _exclusively_ deals with low-level E2ES-centric operations/.

Token Provisioning in browsers is currently entirely based on /third-party proprietary and mostly secret "plugins"/.

Anders Rundgren
http://webpki.org/auth-token-4-the-cloud.html

---

From: "Miller, Timothy J." <[email-masked]>
Date: Fri, 26 Aug 2011 08:39:54 -0400

So I keep wondering where the right forum for this discussion is.  Clearly token management has an interface with PKI systems, but that's as far as it goes.  I don't think TMS standards are in scope here, but then I don't know a body where it would be *in* scope.

-- T

On Aug 25, 2011, at 3:05 PM, Anders Rundgren wrote:

> KeyGen2 is not a Certificate Enrollment protocol; it is a Token (cryptographic module) Provisioning protocol.
> 
> Unlike Certificate Enrollment which essentially only requires a request-response pair where the response (certificate) can be securely derived to request, Token Provisioning usually needs additional steps before and after the core message exchange as well.
> 
> Also in contrast to Certificate Enrollment protocols, Token Provisioning always targets a specific token container.
> If secure Token Provisioning is to be performed by remote users over the Internet, E2ES (end-to-end-security) must be enforced, and preferably throughout the entire process.
> 
> Since E2ES cannot be abstracted, a prerequisite is that the issuer and token speak the same language.
> This obviously thickens the plot considerably unless you also standardize the token (with respect to provisioning NB), which was the sole motivation behind KeyGen2's alter ago, the SKS.
> 
> KeyGen2/SKS in similarity to GlobalPlatform relies on a very light-weight security mechanism based on session keys and a two-level client where the provisioning middleware does the "heavy lifting" and handle user interactions, while the token exclusively deals with low-level E2ES-centric operations.
> 
> Token Provisioning in browsers is currently entirely based on third-party proprietary and mostly secret "plugins".
> 
> Anders Rundgren
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Anders Rundgren <[email-masked]>
Date: Fri, 26 Aug 2011 15:12:41 +0200

> So I keep wondering where the right forum for this discussion is.  Clearly token management has an interface with PKI systems, but that's as far as it goes.  I don't think TMS standards are in scop…

You are absolutely correct!  This is outside of what any SDO could possible deal with.  Not even TrustedComputingGroup which I'm an invited expert member of dared addressing TPM key-provisioning from
a browser.

Anders