IETF Logo Mail Archive

Re: [lamps] On the need for standardization of software-based interoperable private keys [was: Re: draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)]

Tomas Gustavsson <tomas.gustavsson@primekey.com> Thu, 05 August 2021 12:45 UTC

Return-Path: <tomas.gustavsson@primekey.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C4753A0FF6 for <spasm@ietfa.amsl.com>; Thu, 5 Aug 2021 05:45:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=keyfactorinc.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4lxxqQR-sNrv for <spasm@ietfa.amsl.com>; Thu, 5 Aug 2021 05:45:11 -0700 (PDT)
Received: from NAM04-BN8-obe.outbound.protection.outlook.com (mail-bn8nam08on2138.outbound.protection.outlook.com [40.107.100.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 491593A100D for <spasm@ietf.org>; Thu, 5 Aug 2021 05:45:11 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=enzlpH42aZIdxy3w735HLTkayuWCjyfmUceOOZo915ia5tMlKqKsClWUMmH0TWTtl9x04+wLoW7ydmt+Ggir8Rs8x+NnF1l93A6ScUHvty5Ya/I0nSD/1oQfc23e41Jwa7yAiodB3VDfz7OUZOcvd6cQYC7c3fd+efrprKxwy1I++6JzgKXWmFqeasE5IoCB2gHtBMYr0QVn9etmR5ZxTbG9p6AG21iPBxLR/X+6Mr/wmgrSZfqrO2PeREK/66/LwObLh0855NskOW55NB5FGu6iRcdKKtE+hxWA/hMssI0BlNOiakvZGbd52We7zJBgS6HbOfcvQDgUMSKq4d9mXA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DF9twJUxQIcg0kk4YV/AD58AxxuNtWLU/ubbuLv2OWM=; b=fASb8uuJqYVD1Rdap8s5o084cxl4gI0VxyOVXowcezEJRknskjd8k13cPy9+P50MnMN5wQ3Umzp5NY+Hm+2BiKB5q9182dEtCpIUxACKyF6j7uIEFl/tv+u/kzP+CGkzhEqdv2hp0Q3zgbhDRl0qzuKv0qJsPnm7COdwlp+8nQl3nyvsviWRay0ddrVOZvaqmMWjLYhK98HSfieHA+hkfg/zZmGFRQFTCIbhY3Gga7CQyS9kNiIubva77+c14MBTLdjMdNjXsdkIxevzR9sxQkoO+3tf0GNpFmujp8RUx1y869XbTJQiAvrdW7jcuQdKdec55LDWEoBnP6BkuyaRkg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=primekey.com; dmarc=pass action=none header.from=primekey.com; dkim=pass header.d=primekey.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=KeyfactorInc.onmicrosoft.com; s=selector1-KeyfactorInc-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DF9twJUxQIcg0kk4YV/AD58AxxuNtWLU/ubbuLv2OWM=; b=YTfB7g43bLL5qlpVUH4aHIW/PZdHO07HMNmMyHnYIroVbKtKvxn2GU00inxt1fGkfRcG0GTwby9PIk5sSoru88/xLDTxALsJ8IZTdNHYz6GjtTgsZUeBNyVpbd6I/cFxvbvhNCiaXjcIl/v3dXZDovpeQzl2pLu9eiVeLRba2N4=
Received: from SA2PR22MB2537.namprd22.prod.outlook.com (2603:10b6:806:145::13) by SA2PR22MB2522.namprd22.prod.outlook.com (2603:10b6:806:14b::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4373.21; Thu, 5 Aug 2021 12:45:08 +0000
Received: from SA2PR22MB2537.namprd22.prod.outlook.com ([fe80::7519:b1f2:c160:b8b7]) by SA2PR22MB2537.namprd22.prod.outlook.com ([fe80::7519:b1f2:c160:b8b7%8]) with mapi id 15.20.4373.027; Thu, 5 Aug 2021 12:45:08 +0000
From: Tomas Gustavsson <tomas.gustavsson@primekey.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Daniel Kahn Gillmor <dkg@fifthhorseman.net>, LAMPS WG <spasm@ietf.org>
Thread-Topic: [lamps] On the need for standardization of software-based interoperable private keys [was: Re: draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)]
Thread-Index: AQHXifPZ9VMJTYk5wEqH6VfIwUjhTqtk2EQAgAABwtw=
Date: Thu, 05 Aug 2021 12:45:08 +0000
Message-ID: <SA2PR22MB2537BB784F2327052238317FE8F29@SA2PR22MB2537.namprd22.prod.outlook.com>
References: <87czr0ww0d.fsf@fifthhorseman.net> <FF939B28-528B-47F9-9C0C-6585D1B02FBE@vigilsec.com> <87mtq3ukk0.fsf@fifthhorseman.net> <CAErg=HHQMZ1jk+bVxA=MzVvW+9ucie7bu-N6O8Asnp0V8Rf9Bg@mail.gmail.com> <30546.1627850836@localhost> <CAErg=HHKL-E5yT0UnPKcLfMQU41iDg7GGgjsSXs3eRg8daJRkg@mail.gmail.com> <87wnp347iu.fsf@fifthhorseman.net> <1388.1627996026@localhost> <87pmuu42hf.fsf@fifthhorseman.net> <20862.1628113377@localhost> <656985A5-BED4-4BA8-9233-B3C93966016C@ll.mit.edu> <877dh03x35.fsf@fifthhorseman.net>, <722a1f15-8ac8-54f2-3c7a-14c7ed92c6ef@cs.tcd.ie>
In-Reply-To: <722a1f15-8ac8-54f2-3c7a-14c7ed92c6ef@cs.tcd.ie>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: cs.tcd.ie; dkim=none (message not signed) header.d=none;cs.tcd.ie; dmarc=none action=none header.from=primekey.com;
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: f127e39d-db28-488f-8bce-08d9580edba9
x-ms-traffictypediagnostic: SA2PR22MB2522:
x-microsoft-antispam-prvs: <SA2PR22MB2522CA1F72F1662489388C03E8F29@SA2PR22MB2522.namprd22.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: RUo9WWJq3G6Lz1ptzgjdPIVTZCheN9lt1795DjKAvxHzkOY7HibPj+YUtRMuf9h+6vuni9/z21vhd6IpIYbv6fUyBIIJvZHQD1bA8Gz/MKwVyq9qCxOipLvDLkPw/IJUc3niU0ZPCKepcd+FssT1H9le1AnTa3ZZmpMiLk7rdGrK4MH4opam4690Vey0iIMAfgyVaLnhuLIQ4qZ2j2QmOPcx8fERkDQBMKlQ+pdkjSmc5j/J95q1PSUZwPLqdAUVlUr/uytyUn03KF2BdJEB6yRk+Hrs2NY1qGCdcSt17gXQKARlv/wk468qKkPp1UjsE4Tl436alCFcWAf5pH9gMNyLxXf9wfzFlbFXFhv3eSG9efayLIWfjGqG2SE+vmmYNDcvuTdY74LwCSEo9ZFy++MfQWbKeCW5RQqx+JFI/wMprVvR8oZDIZBrjHWO431pE3uCB7RdfH09LQFY6EFsl8KauOyaSsifxXkLEp9raihnxNijAvv34OYYbDiPCC/y+Z9oYdb4lkPnGzbQsgmK2yi6ZMQz8JtHV+vUpuuP9b55Z2yFd7DzYmIj9GUykqVBeUXTUWuoWKugVmLP2GQFpgDcEzgwkwcNSkH5A0LGQ/2N4lnKLMk8jLdVOByVVf8/QSBeL2wIO0Gvu9cvtcitSgETL4j+suMJsKhqzm0w3iWhZfZ+Y6C+5uOK8yNcG6PsQLdBiFpnGnMEXScRkQ7ZHwgNwH/7miEV4qyr+SpR5uf4YmkezYKJb/shvi2maWcXHmA9WfVhkJqgvNxwEjZIWFecnX8DcBmpATx7UOtANxcd1T+jNfgYf7U4zbvZnXdV
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA2PR22MB2537.namprd22.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(39850400004)(366004)(136003)(346002)(376002)(55016002)(8936002)(166002)(71200400001)(66446008)(66476007)(38070700005)(66556008)(19627405001)(33656002)(44832011)(64756008)(86362001)(9686003)(38100700002)(8676002)(2906002)(296002)(122000001)(52536014)(45080400002)(5660300002)(316002)(6506007)(53546011)(76116006)(91956017)(26005)(966005)(66946007)(7696005)(478600001)(186003)(83380400001)(110136005)(85893002); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: vU5oTXXkCcmIg7P8AUXVBPR0MxYTHLNqYImacx1qx5TfOGW6Lew7zYJjf3TwXxpYb+zEnLJAFfHmhp8K08IFO3HuIlki7J7eZInR4CxQWrAfGLjlFku9pYHmIW5a60S+NX23qk0fB6QkJFlihLqfMrW/dyrLTHOtRhqkqHRTcpbRFIi5v8S2MEXuHfKPKxUaOG5t8/Rj/eysarJTtOQT2AgTwjHZ8+DePHdilqK9Wt4U/LVTqv6yl1eiH4L1VwhuYeNk2aSVRla04XAtXk+p6+QObIvQ9thxAYQWEmKI7CTxLylV1VrOXLufnyUNYXK11mTH3ENk8W842NynXGcChhYsFOluQQauh1jPhftPlLc4WSaKSHgIvgjWAYZ8bR3J/9MHUf21et4GgRDXRpXq+5z0QkNoZTypqUqOSBwzkCQEOEOdZtaESnr430B0W91xHUTSiNI3S7kBbIufV3s3NlaIBqOtihlgpVUwfolz8T8pwMse4/qbDzFrYrpKbLg6VVNR3FWzWR3e9E4Dn/Wgj/3kvlWoeh1suVr2HN3juDaObbcyCOOu3Ccur7UbjInPOV63wXDy/2UTdivy0ijbXK7Hr7SCpmInsjjLAnr8djycH4D4VmHYedkmCvssKCPQZRNu6hTlrmCi8fivGysN2rJGi1x5d8sxbZZ43Vy5K5qwOG3aC4iI6qmad0lWBGsdbzYtsgVJkF4KhTWlI1Iz/q6/C/HPA0Myo/zpz5VhodkEjpIkSKioHYcBEuf3eAXDdh60Nq7VAZp2dnP858Y5N0CCxkS4/nX6zK9l3eFN8y2dik4Xt5cWqJBoSFzAYyIbe42NZ7QIfbVIePdMzKyEIy2l4cM9BC+qEIF5IkSTmrAdMN0uOzw0nKa284lXpR7SVNp2fph4jhhOCWuz5B3uPOhosLPAlWnxQhS7G+ficdd69eJc146lih0OWD3oiGICgondr7WTYYm+sHUXOWc6PvYp+vgf+fXkIMViJ6AJxbtzO7++1PxAnuWT2l1eWhGCqQpWEbbkgw4XY0BbhB1VRkHgN4nsz4Z2gw7bhkt83X9Qe9ETwnRrMrnpIr5UpE7Wmt7RsZDXBk/TwXa4fJYr9FeMEHiSZzoGofkVf5qDQK5drEjlrc0RRlXSLiKmF7wInoBXM2DzqdJNtp8KVrbHPZeUtMAasSXbJntXzPhmbNTdcqEnNMqXnr5ZIsTm9shIxkhisRuy6+j68lutr9xHZYqk7Pbwh532Hr2oceLlHqWJ9nDOQL6eJ7rHI9uAdI/TZf9MUuaCABR3erjxIy69iO4QKd36qTe565kCv+jWx/TznYYclE92NfSt9VOMGqJU
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_SA2PR22MB2537BB784F2327052238317FE8F29SA2PR22MB2537namp_"
MIME-Version: 1.0
X-OriginatorOrg: primekey.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SA2PR22MB2537.namprd22.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f127e39d-db28-488f-8bce-08d9580edba9
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Aug 2021 12:45:08.6449 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: c9ed4b45-9f70-418a-aa58-f04c80848ca9
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 8HW52RZGjXvrJMoGeVLDjjHbJshzwrVNzh6BCEciopG2hxFgE/kNCWjdop11tChjHTcZy+ygIh4PWp6hWk/Un+ZD5bYxq6/1/+vJv7O5FOE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR22MB2522
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/pHPgJuNXBjQt2B2p5ubv8pCTWPc>
Subject: Re: [lamps] On the need for standardization of software-based interoperable private keys [was: Re: draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)]
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Aug 2021 12:45:17 -0000

I have dreamt for a long time that there would be an interoperable data exchange format for keys and certificates (think Token/HSM backup/restore). Something more efficient and user friendly than individual PKCS#8 and PEM files. I think it potentially could advance things that is imho held back by lack of interoperability and lock-in. Whether applications would adopt is a good question however. I don't represent a token vendor, just a user who think I see a benefit, so...

Cheers,
Tomas
________________________________
From: Spasm <spasm-bounces@ietf.org> on behalf of Stephen Farrell <stephen.farrell@cs.tcd.ie>
Sent: Thursday, August 5, 2021 2:33 PM
To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>; LAMPS WG <spasm@ietf.org>
Subject: Re: [lamps] On the need for standardization of software-based interoperable private keys [was: Re: draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)]

CAUTION: External Sender - Be cautious when clicking links or opening attachments. Please email InfoSec@keyfactor.com with any questions.


Hiya,

On 05/08/2021 13:17, Daniel Kahn Gillmor wrote:
> I sympathize with the grumbling about it, but I'd hope that the experts
> in the IETF LAMPS WG can at least come to a consensus that there is
> value in standardizing interop for decryption-capable private keys.

We tried that before [1] but it might be worth
another shot. The previous attempt got wrapped
up in a then-fashionable transport that never
really took off and was also affected by now-
expired IPR.

That'd need to be a separate WG though. Not
sure if it'd be better scoped to mail or to be
more broad.

I think the critical question, then as now, is
whether or not applications would adopt.

Cheers,
S.

[1] https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fwg%2Fsacred%2F&amp;data=04%7C01%7Ctomas.gustavsson%40primekey.com%7C9f66bfa597fd4ceb346c08d9580d4501%7Cc9ed4b459f70418aaa58f04c80848ca9%7C0%7C0%7C637637636287867009%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=2D43V9LfLHXtkzRWZnAfF0HlLSOySFTWHKyldxE3moc%3D&amp;reserved=0

v2.23.0 | Report a Bug | By Email