[saag] PKIX report

[Stephen Kent <[e-mail]>]

PKIX met once, for 2.5 hours on 3/27, with about 52 attendees.

Three presentations addressed issues with OCSP. Stefan Santesson 
discussed his plans for making substantial changes to 2560bis (OCSP 
clarifications), to cause it to better match deployed OCSP client and 
responder behavior. Sean Turner urged Stefan to complete work on this 
document so that it can yield an RFC prior to the end of this year. 
Denis Pinkas described several concerns about both the original OCSP 
spec (2560) and the clarifications document. Stefan agreed with many 
of Denis's observations. A later presentation by Denis  dealt with 
recent PKIX list discussions of extensions for OCSP, and how the 
clarification document may help with these issues.

There was a brief discussion of issuing an updated version of the 
Diffie-Hellman PoP RFC (2875), in support of algorithm agility, e.g., 
to accommodate new hash algorithms and EC Diffie-Hellman. This work 
may be done inside of PKIX, or fast-tracked by Sean.

A presentation on a proposed EKU was inconclusive. The motivation for 
assigning an OID for the requested EKU from the PKIX arc is based on 
behavior of commercial CAs (TAs in web browsers) when issuing server 
certificates. This behavior is outside of PKIX specs, and there is no 
indication that these CAs would agree to issue server certificates, 
which makes it unclear that assignment of this EKU would have the 
desired effect. The authors of the (non-PKIX) I-D were advised to 
participate in the JSON and ABFAB WGs.