Subject: [saag] PKIX summary

From: Stephen Kent <[email-masked]>
Date: Thu, 25 Mar 2010 14:19:43 -0400

PKIX met once, for 2 hours, on Monday, 3/22, and attracted about 53 attendees.

We had four presentations on WG documents: Trust Anchor Management 
docs, ASN.1 translation, Certififate Image, and the 5280 
Implementation report.  The last of these was the most significant, 
as we discussed how to address the lack of implementation support in 
two areas: string encodings for the user notice text in a policy 
qualifier, and lack of demonstrable support for string prep in 
internationalized names, e.g., for IDNs expressed as domain 
components in DNs.  The plan is to publish 5280bis, with just the 
fixes needed to achieve progression. Details of the necessary changes 
are being worked out on the list.

We also had five presentations on "related: topics: Suite B profile 
for CMC, approaches to addressing hash function vulnerabilities wrt 
cert revocation, server identity checking in TLS, cert key ID, and 
proxy architecture for DRM services. The first is an independent 
submission that was briefed to PKIX as a courtesy, by our new SEC AD. 
The second was a set of preliminary ideas on how to deal with the 
cited problem. The this was a briefing about a document that is very 
much related to PKIX, but perhaps ore closely related to TLS.  the 
fourth briefing closed a topic that had been discussed on the list, 
with agreement to cite the ESSCerttIDv2 as the preferred way to refer 
to certs.  The last presentation was a high-level discussion of one 
method for managing authorization delegation in a user/proxy/server 
PKI context.