Although probably not NIST's intentions with SCVP,
I would not be surprised if SCVP long-term will put the final nail in the Bridge
CA coffin.
Off-loaded validation is a MUCH better concept since it is fully
dynamic, allows arbitrary granularity down to individual EE certificates, and
most of all does not rely on a centrally funded/trusted "über-CA". In
fact, a successful rollout of SCVP will probably eliminate most other uses of
cross-certification as well.
Anders
----- Original Message
-----
From: "David A. Cooper" <
david.cooper <at> nist.gov>
To:
"pkix" <
ietf-pkix <at> imc.org>
Sent: Friday,
July 06, 2007 23:17
Subject:
draft-ietf-pkix-scvp-32.txt
All,
I just submitted draft 32
of SCVP for posting. This draft contains some
editorial changes to
address comments raised as a result of IESG review,
but there are no changes
to the protocol, either syntactic or semantic.
A diff file comparing drafts
31 and 32 is available at
http://csrc.nist.gov/pki/documents/PKIX/wdiff_draft-ietf-pkix-scvp-31_to_32.html.
I should note that this draft does not address every
issue raised during
the IESG review. In particular, there are still
outstanding comments
from Lisa Dusseault relating to the use of HTTP, which
is mainly
specified in Appendix B of SCVP. Lisa's comments may be found
at
https://datatracker.ietf.org/idtracker/draft-ietf-pkix-scvp/comment/65322.
If there is someone who has a sufficient knowledge of
HTTP to address
the issues that Lisa raises and who is willing to work with
us to
resolve these issues, that would be
appreciated.
Dave
] On Sat, 2007-06-23 at 16:46 -0400, Scott Lawrence wrote: > draft-gurbani-sip-domain-certs-05 has been submitted to > the IETF archives. We've tried to incorporate some of the advice we got > around the Prague meeting. > > This version focuses fairly narrowly on: > > - How to use and interpret the SIP identities in a X.509 certificate. > - How to indicate that this particular certificate is for SIP > usage. > > What goes in the subjectAltName, and a new EKU value, with the detailed > steps to interpret and validate them are provided from the viewpoint of > user agents, proxies, and registrars. > > Until the -05 version appears in the archives, you can get it from: > > http://svn.resiprocate.org/rep/ietf-drafts/gurbani/domain-certs/draft-gurbani-sip-domain-certs-05.txt > http://svn.resiprocate.org/rep/ietf-drafts/gurbani/domain-certs/draft-gurbani-sip-domain-certs-05.html > > Comments, questions and other feedback is much appreciated. The authors would particularly appreciate some expert PKIX review on whether or not the usage of the suggested Extended Key Usage reasonable and (at least potentially) effective? This is described in sections 5 and 8.1:
RSS Feed