Re: [Acme] Proposed ACME Charter Language

[Stephen Farrell <[e-mail]>]

Hi Russ,

On 20/04/15 17:11, Russ Housley wrote:
> Stephen:
> 
> If that paragraph were removed, would you be happier with the
> charter?  If so, consider it gone.  

I would be happier yes. But I think we're better off having the
discussion now, before chartering, since otherwise we may end up
re-doing it a number of times.

If that discussion ends up with rough consensus for a "don't
duplicate" position then text such as you propose would be correct.
If that discussion ends up with rough consensus on a "duplicate
away, earlier efforts failed" position then it'd probably be a
good idea to say so in the charter text. (So, your bit of puzzling
text is very useful in the end - it may force us to get this out
of the way early.)

> I'm willing to assume that an
> attempt to replace things that people are using will meet with
> vigorous discussion.

Right. People are using CMC, but not afaik when dealing with any
public CAs for getting certificates for public Internet services.
I think CMP has some similar but much smaller set of real uses. (*)
And I'm not sure if EST has gotten traction. SCEP has uses but
that's another kettle of cans of worms and fish;-)

I think it would be better to have the vigorous discussion about
CMC vs.ACME-JSON-etc (if that's the one we need to have) before
we form the WG. But is that in fact the meat of your concern here?
If so, then I assume you'd be arguing for use of CMC/CRMF PDUs
in ACME messages. If not, I'm not back to being puzzled. Can you
clarify?

Cheers,
S.


(*) Last I checked, there still were a set of real users of CMP that
meant it would be wrong to declare it HISTORIC. If that's changed
since, it might be a fine thing to do though, and I'm happy to help
there, so if anyone has info please let us know, though that'd be
better done via mail on the pkix list (and then saag) and not here.


> 
> Russ
> 
> 
> On Apr 20, 2015, at 12:05 PM, Stephen Farrell wrote:
> 
>> 
>> 
>> On 20/04/15 16:57, Russ Housley wrote:
>>> Stephen:
>>> 
>>> I did not see the ACME effort as trying to throw everything out.
>> 
>> If it is not used, then I don't think we're throwing it out:-)
>> 
>>> Rather, throw out the parts that have been an impediment to the
>>> kind of automation proposed by ACME, but document the
>>> shortcoming.
>> 
>> Sorry, I'm still not getting it. I don't see any need for ACME to
>> document why CMP etc failed or what was wrong with CMP that may
>> have caused it to fail. And the same for CMC etc. BTW by "fail"
>> here I mean: not used by the major deployed PKIs on the public
>> Internet.
>> 
>> I also see no need at all to even try to re-use ASN.1 PDU 
>> structures that are defined in CRMF etc.
>> 
>> I do think that ACME ought learn from the past of course, and am
>> confident that there will be enough participants involved who have
>> that history for that to not be problematic.
>> 
>> But I do not think ACME ought be required to re-use any ASN.1 PDU
>> definitions from any previous RFCs on this topic.
>> 
>> Do we agree or disagree on that last? (I'm trying to get to quite
>> specific meanings for "duplicate.")
>> 
>> Cheers, S.
>> 
>> 
>> 
>>> 
>>> Russ
>>> 
>>> On Apr 20, 2015, at 11:43 AM, Stephen Farrell wrote:
>>> 
>>>> 
>>>> Hi Russ,
>>>> 
>>>> This bit puzzles me a lot, other bits puzzle me a little:-)
>>>> 
>>>> On 20/04/15 16:23, Russ Housley wrote:
>>>>> The ACME WG will not duplicate work from previous IETF 
>>>>> certificate management efforts.
>>>> 
>>>> If accepted, that would seem to me to nullify the entire
>>>> effort. Can you explain why I'm reading it wrong?
>>>> 
>>>> ACME absolutely will duplicate work from previous IETF
>>>> certificate management efforts that have failed to get traction
>>>> over the last decade and a half. That is entirely fine IMO and
>>>> needs no explicit justification whatsoever since we have 15
>>>> years of crystal clear non-use, outside of niche environments.
>>>> (It is true that what is now considered a niche was not so
>>>> considered back then.)
>>>> 
>>>> In fact I believe anyone who claims such duplication is a
>>>> problem should be the one to provide evidence for that by
>>>> documenting exactly why and at what scale.
>>>> 
>>>> It is just not credible for us to pretend that CMC, CMP, or EST
>>>> are widely used for certificate management on the public
>>>> Internet. If I'm wrong there I would really love to see the
>>>> evidence but absent such, duplicating bits of functionality
>>>> present in current RFCs that are not at all widely used is what
>>>> is needed for this effort and needs to be encouraged.
>>>> 
>>>> I think we really ought bottom out on this aspect before
>>>> chartering - it'd be dumb of us to charter an ACME WG that has
>>>> to fight all the CRMF battles over again, or the ASN.1 vs.
>>>> whatever issues. So I hope lots of voices chime in and say what
>>>> they think.
>>>> 
>>>> S.
>>>> 
>>>> _______________________________________________ Acme mailing
>>>> list [e-mail] https://www.ietf.org/mailman/listinfo/acme
>>> 
>>> 
>>> 
> 
> _______________________________________________ Acme mailing list 
> [e-mail] https://www.ietf.org/mailman/listinfo/acme
>