Subject: Re: [pkix] Fwd: I-D Action: draft-turner-est-extensions-02.txt

From: "Dan Harkins" <[email-masked]>
Date: Fri, 9 May 2014 17:22:46 -0700 (PDT)

On Wed, April 30, 2014 8:56 am, Anders Rundgren wrote:
> On 2014-04-30 16:31, Sean Turner wrote:
>> Some on this list might find this of interest.
>
> I never understood the use-case for EST and this addition didn't made it
> clearer.

  It is for enrollment into a CA using an existing credential like username/
password or another certificate. It can be used, for instance, by network
infrastructure devices (access points, switches, routers) to authenticate
to an RA with a manufacturing certificate and enroll in a CA. It can be
used to enroll client devices (phones, laptops, etc) into a CA for
subsequent network access.

> I guess this is something ordered by the US government?

  Not that I know of, although if the US government does require EST,
that requirement is not the sole driver for EST. It is also a requirement
for the Wi-Fi Alliance's "Hot Spot 2.0" effort, as a for instance.

  Dan.

> Anders
>
>>
>> spt
>>
>> Begin forwarded message:
>>
>>> From: [email-masked]
>>> Subject: I-D Action: draft-turner-est-extensions-02.txt
>>> Date: April 30, 2014 at 10:29:54 EDT
>>> To: [email-masked]
>>> Reply-To: [email-masked]
>>>
>>>
>>> A New Internet-Draft is available from the on-line Internet-Drafts
>>> directories.
>>>
>>>
>>>        Title           : EST Extensions
>>>        Author          : Sean Turner
>>> 	Filename        : draft-turner-est-extensions-02.txt
>>> 	Pages           : 41
>>> 	Date            : 2014-04-30
>>>
>>> Abstract:
>>>   The EST (Enrollment over Secure Transport) protocol defined a Well-
>>>   Known URI (Uniform Resource Identifier): /.well-known/est.  EST also
>>>   defined several path components that clients use for PKI (Public Key
>>>   Infrastructure) services, namely certificate enrollment (e.g.,
>>>   /simpleenroll).  In some sense, the services provided by the path
>>>   components can be thought of as PKI management-related packages.
>>>   There are additional PKI-related packages a client might need as well
>>>   as other security-related packages, such as firmware, trust anchors,
>>>   and symmetric, asymmetric, and encrypted keys.  This document also
>>>   specifies the PAL (Package Availability List), which is an XML
>>>   (Extensible Markup Language) file that clients use to retrieve
>>>   packages available and authorized for them.  This document extends
>>>   the EST server path components to provide these additional services.
>>>
>>>
>>> The IETF datatracker status page for this draft is:
>>> https://datatracker.ietf.org/doc/draft-turner-est-extensions/
>>>
>>> There's also a htmlized version available at:
>>> http://tools.ietf.org/html/draft-turner-est-extensions-02
>>>
>>> A diff from the previous version is available at:
>>> http://www.ietf.org/rfcdiff?url2=draft-turner-est-extensions-02
>>>
>>>
>>> Please note that it may take a couple of minutes from the time of
>>> submission
>>> until the htmlized version and diff are available at tools.ietf.org.
>>>
>>> Internet-Drafts are also available by anonymous FTP at:
>>> ftp://ftp.ietf.org/internet-drafts/
>>>
>>> _______________________________________________
>>> I-D-Announce mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/i-d-announce
>>> Internet-Draft directories: http://www.ietf.org/shadow.html
>>> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>>
>> _______________________________________________
>> pkix mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/pkix
>>
>
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix
>