Re: [pkix] Derived Credentials. Was: Simple Certificate Enrollment Protocol (SCEP)

[Anders Rundgren <[e-mail]>]

On 2014-11-12 18:42, Johannes Merkle wrote:
> Anders Rundgren wrote on 12.11.2014 10:25:
>> On 2014-11-12 10:03, Max Pritikin (pritikin) wrote:
>>> Anders - both of these requirements can be met by these protocols.
>>
>> AFAICT, end-to-end security with respect to the *key-container* is outside of all
>> PKIX enrollment protocols.  No CMS (Card Management System) use CMP, SCEP, EST
>> directly, they use other protocols for actual token provisioning/initialization.
>>
>
> This is not correct. I have participated in the implementation of two Card Management Systems that use CMP for smart
> card initialization and provisioning. Both are operative, the first one managing over 8 million cards, the second one
> over 60.000.
>

You always need a proxy between the card and CMP.  Such a proxy may do things
like card initialization, PIN-assignment etc.  CMP (like all PKIX protocols)
also assume that it is the client (in this case the proxy) that specifies
key algorithms since it is a strict client-server protocol.  I.e. "key agility"
with respect to the issuer (who usually have the policy) is also missing from
the PKIX plot.

Anders