Re: [pkix] Simple Certificate Enrollment Protocol (SCEP)

[Peter Gutmann <[e-mail]>]

Erik Andersen <[e-mail]> writes:

>The smart grid security folks want to use SCEP as normative reference in
>their specification. 

It's already being used in a variety of SCADA applications (and is required in
some SCADA standards), so they're in good company there.

>In the current state of SCEP, this is probably against the rules of IEC. It
>might be desirable to progress SCEP to a more official status. That could be
>within PKIX as an RFC or as an ITU-T Recommendation to be progressed very
>quickly. The latter might require some consent from Cisco.

That's going to be tricky, Cisco really wants people to forget about SCEP and
move onto EST (thanks to Michael Jenkins for pointing out the name, I was too
lazy to Google it :-).  I've submitted a bunch of corrections to SCEP (there
are some things that were bolted on later that really don't work as specified,
or under-specified, in the spec) but haven't been able to get any traction on
it.  At the moment I don't know what it'd take to get SCEP published as any
sort of standard.  OTOH as you point out it is a very widely-used de facto
standard, while the actual "standards" (CMP, CMC, etc) barely exist and don't
interoperate when they do).

It's a bit of a COBOL vs. OCaml thing, one is old and clunky and just gets the
job done (SCEP), the other is complex and full of esoteric features and only
understood by about seven people, three of whom mutter to themselves a lot and
aren't allowed near sharp objects because of what they might do with them
(CMP/CMC/etc).

Peter.