Re: [lamps] Proposed Re-Chartering Text for CMP updates and lightweight profile (RE: Follow-up on lightweight CMP profile)

["Brockhaus, Hendrik" <[e-mail]>]

Hi Panos

Thank you for your thoughts and feedback.
I hope my comments below explain our approach and idea better.

Hendrik

Von: Panos Kampanakis (pkampana) <[e-mail]>
Gesendet: Donnerstag, 9. Mai 2019 20:56
An: Brockhaus, Hendrik (CT RDA ITS SEA-DE) <[e-mail]>; [e-mail]
Cc: Jim Schaad <[e-mail]>; Russ Housley <[e-mail]>; Fries, Steffen (CT RDA ITS) <[e-mail]>
Betreff: RE: Proposed Re-Chartering Text for CMP updates and lightweight profile (RE: Follow-up on lightweight CMP profile)

Hi Hendrik,
Understood. I don't question that CMP has it uses; I wanted to avoid a new profile causing confusion in areas where there were other options.
[Bro] I don't think the profile causes confusion. It just eases the use of CMP. Finally, it is up to the vertical to decide which enrollment protocol to use. As already discussed, there are use cases for different architectures. Features like binding to a secure transport may be an advantage for some use cases and a disadvantage for others, which rely on end-to-end security in an environment with multiple hops.
Another question.  Why is this a LAMPS item? Creating a CMP profile that applies to a specific vertical resembles a recent case where a draft was brought to the TLS WG for V2V certificates in TLS. The TLS WG did not pick up the draft because of lack of interest and the narrow usecase. Why should this item be part of the LAMPS charter and not ISO ICS or IEC that seem more natural homes?
[Bro] Agreed! We target a generic lightweight profile for CMP which we would like to apply to industry. Similar profiles have already been specified by 3GPP for telecommunication. We write the I-D independent from any vertical, just specifying the certificate management use cases more precisely.
As described in my initial mail, there is some very limited update of CMP needed to allow for the needed crypto agility and possibly to clear up some imprecision. This is like the updates to CMC in RFC6402. We understood LAMPS as maintainer of PKIX RFCs.
As the CMP profile aims to be a general-purpose profile, I also believe that this is an IETF topic. As there is much expertise in LAMPS on these topics, I would also appreciate, if this could be handled in this WG, too.

Thanks,
Panos


From: Spasm <[e-mail]<mailto:[e-mail]>> On Behalf Of Brockhaus, Hendrik
Sent: Wednesday, May 08, 2019 11:02 AM
To: Panos Kampanakis (pkampana) <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Cc: Jim Schaad <[e-mail]<mailto:[e-mail]>>; Russ Housley <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: Re: [lamps] Proposed Re-Chartering Text for CMP updates and lightweight profile (RE: Follow-up on lightweight CMP profile)

Hi Panos,

missed you in Prague.

Steffen had a discussion on the focus of our CMP profile with Jim after the ACE meeting in Prague. May be we did not focus enough on industrial use cases. Our focus in not in the first place on constrained devices, but we believe that CMP would also work perfectly on all those devices capable to run TLS.
Currently CMP is already used in mobile networks and in rail networks.. But we see the need to specify the needed uses cases in more detail to get interoperable implementations.
The big advantage of CMP for industrial use is that we do not have any security requirements to the transport of the messages, since CMP messages are self-contained and support end-to-end security.  A hop-by-hop security or asynchronous transport is not always feasible.

Hendrik

Von: Panos Kampanakis (pkampana) <[e-mail]<mailto:[e-mail]>>
Gesendet: Mittwoch, 8. Mai 2019 16:00
An: [e-mail]<mailto:[e-mail]>; Russ Housley <[e-mail]<mailto:[e-mail]>>; Brockhaus, Hendrik (CT RDA ITS SEA-DE) <[e-mail]<mailto:[e-mail]>>
Cc: Jim Schaad <[e-mail]<mailto:[e-mail]>>; Fries, Steffen (CT RDA ITS) <[e-mail]<mailto:[e-mail]>>
Betreff: RE: Proposed Re-Chartering Text for CMP updates and lightweight profile (RE: Follow-up on lightweight CMP profile)


Hi Hendrik,

Long time since we talked.

With such a profile, I have a concern that what happened with SCEP, CMC, CMPv2, EST is likely to happen in constrained environments. Using two or more protocols (EST-coaps, a CMP profile over different transports, and others) that do similar things would lead to fragmentation and confuse vendors that want to pick one.

I am not sure I have heard a broad need for a CMP profile in ACE. If this is a single vendor need, does IETF even need to standardize this CMP profile?

Panos


From: Spasm <[e-mail]<mailto:[e-mail]>> On Behalf Of Brockhaus, Hendrik
Sent: Wednesday, May 08, 2019 5:10 AM
To: [e-mail]<mailto:[e-mail]>; Russ Housley <[e-mail]<mailto:[e-mail]>>
Cc: Jim Schaad <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>
Subject: [lamps] Proposed Re-Chartering Text for CMP updates and lightweight profile (RE: Follow-up on lightweight CMP profile)

Hi Russ, all,

as discussed at IETF104 and on this list we would like to spend further work on updating and profiling CMP focusing on industrial use cases.
To get input, feedback and support from LAMPS we propose the following charter text.

As certificate management gets increasingly important in industrial environments, it needs to be tailored to the specific needs. CMP as existing protocol offers a vast range of options. As it is already being applied in industrial environments it needs to be enhanced to more efficiently support of industrial use cases, crypto agility and specific communication relations on the one hand and profiled to the necessary functionality on the other hand to ease application and to better facilitate interoperable implementation.


Hendrik

Von: Russ Housley <[e-mail]<mailto:[e-mail]>>
Gesendet: Mittwoch, 8. Mai 2019 02:18
An: Brockhaus, Hendrik (CT RDA ITS SEA-DE) <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>; Jim Schaad <[e-mail]<mailto:[e-mail]>>; Fries, Steffen (CT RDA ITS) <[e-mail]<mailto:steffen.fries@siemens..com>>
Betreff: Re: [lamps] Follow-up on lightweight CMP profile

Hendrik:

The current re-charter is about two weeks away.  You would need to propose text for the charter on this list, and see if there are people that will review and implement.

Russ


On May 3, 2019, at 4:52 AM, Brockhaus, Hendrik <[e-mail]<mailto:[e-mail]>> wrote:

Hi all

Referring to the Email thread 'Seeking guidance on proceeding with question from IETF-104 presentation on lightweight CMP profile' and to the outcome of the WG meeting, we want to summarize the current state of the discussion.
The discussion we had with Jim motivate a split of the current draft into a CMP Updates and a CMP Profile document. The update of CMP is needed because we identified at least two point where a change to CMP is needed:
- Change the type of encryptedCert from EncryptedValue to EncryptedKey for ECC and post-quantum algorithm support
- Extend the RootCAUpdate announcement message to e request/response message to enable requesting the update from the client side
The remaining points from the initial email were seen as profiling topic and would therefore be handled in the CMP Profile document...

@Russ, how do you see the status of the current re-chartering process? Would you support to add both, or at least the CMP Updates, activities under the revised charter?

- Hendrik
_______________________________________________
Spasm mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/spasm<https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fspasm&data=02%7C01%7Chendrik.brockhaus%40siemens.com%7C13a5dce99f8142fc6dfb08d6d4aff708%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C636930249563542771&sdata=QnmjZmc5c8kaM9a2RsMsWr7zsRrl9pR7EdPch%2B0q6ac%3D&reserved=0>