Re: [pkix] Simple Certificate Enrollment Protocol (SCEP)

[Stephen Kent <[e-mail]>]

Melinda,
> I was at Cisco at the time.  That is not correct.  Interest in
> bring SCEP to the IETF waxed and waned and at different points
> different people showed different levels of interest in working on
> getting the spec through the IETF process.  Nobody was ever instructed
> to lie -
I don't recall saying they were instructed.
> I'd be hard-pressed to say that anybody was instructed to
> do much of anything in terms of publishing SCEP.
ibid.
> My understanding
> of the 3gpp situation was that someone at Cisco wanted to
> take SCEP to 3gpp and that's what motivated a renewed interest
> in publishing it as an informational document (within Cisco; whether
> the responsible IETF people were more interested in publishing it
> as an historic RFC is largely orthogonal to that).
The individual who showed up at PKIX meetings to push for publication
was someone who had no visible activity in PKIX prior to his arrival
at a WG meeting.

The individual who declared the intent to use the RFC to submit SCEP
to 3GPP was different, and was different from the individuals who had
previously met with us on the topic.

So, yes, it is possible that these two individuals and the others who
engaged with the IETF requesting publication of SCEP had completely
different agendas.

The real issue is that the argument put before PKIX and the Sec ADs,
repeatedly, was that an RFC was needed to provide a stable reference 
document
for SCEP. This is an absurd assertion; Cisco was capable of publishing its
spec on a public Cisco web site, thus making it available to anyone who 
needed it.
Internet search was already adequate (in that time frame) for anyone 
interested
in the spec to find it on such a site. If Cisco vanishes, the doc will 
have been
archived and thus remain available for many years.

The only credible reason for publishing an RFC describing SCEP (with any RFC
label) was to have an RFC number that one could use to claim the 
imprimatur of
the IETF. Whether the RFC number is to be used to cause another SDO to 
accept
the protocol, or for marketing purposes, is irrelevant. Such behavior is 
what
caused me to use the term "lie."

Steve