Re: [pkix] Considerations about the need to resume PKIX work

["Dr. Pala" <[e-mail]>]

Hi Anders,

Maybe, this time we might have a way in. I would be willing to work on 
it (even outside IETF, if there is no interest) and provide 
implementations in LibPKI. Easy and Secure "Provisioning / Enrollment" 
protocols are at the core for many ecosystems (e.g., IoT, WIFI, etc.). 
For the TEEP - I do not think they are going to address this particular 
issue/issues for what I have seen at the BoF.

Let's talk about this - can you send me pointers you might think are 
useful to start from ?

Cheers,
Max


On 7/20/17 2:15 PM, Anders Rundgren wrote:
> Max,
>
> If we stick to the problem with outdated crypto algorithms, the only 
> reasonable solution is updating keys (and software...) when needed.  
> The latter is worked on in the IETF TEEP WG.
>
> Regarding the state of PKI, none of the PKIX enrollment protocols 
> support MFA or key attestations.  In fact, the entire PKIX WG were 
> *against* such ideas (when raised by me) when EST was on the "drawing 
> board". FIDO alliance products (of course) have this as a core facility.
>
> Anders

-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo