Re: [wpkops] [T17Q11] SV: [pkix] X.509 whitelist proposal

["Erik Andersen" <[e-mail]>]

Hi Tony,

 

I have no intention to submit a contribution without the permission from the
Danish ministry. I would be killed.  Before I can submit it, it has to be
approved by two different Danish authorities. The agreement is that I first
distribute it among experts to get any constructive comments that could
improve the proposal before getting it through the approval process within
Denmark.

 

One use case is as follows:

 

An electrical substation (e.g. transformation) has many interconnected
entities. One of these entities is the contact to the outside world. If
something happens within the substation, the situation has to be detected,
commands have to be sent to other entities that that have to process the
command and react to the commands. All this must happens within 10 ms. False
commands would be disastrous in this environment, so authentication is
necessary, but there is no time to validate a long certification path, to
consult OCSP, etc. It is an environment very different from a browser
environment and old solutions do not work here.

 

Kind regards,

 

Erik 

 

Fra: Tony Rutkowski [mailto:[e-mail]] 
Sendt: 18. juli 2014 14:11
Til: Erik Andersen; [e-mail]; [e-mail]
Cc: [e-mail]; [e-mail]; SG17-Q11
Emne: Re: [T17Q11] SV: [pkix] X.509 whitelist proposal

 

Hi Erik,

You have been participating long enough in the ITU-T
to know that it is an intergovernmental body, and one
cannot simply create a contribution using a Member
nation's name - even if you are a citizen - because 
you don't like the "red tape."  It is the Danish 
Administration - the Ministry of Business and 
Growth - that gets to make submissions for 
Denmark, not you.

Denmark ten years ago reduced its ITU financial
contribution by more than a half, and has not
submitted a document into the ITU-T since at
least 2001.  It thus seems unlikely this will occur.

You now say that "the proposal has been submitted
to that group [IEC TC57 WG15} for comments," whereas
your previous message said it "has requested the
inclusion of whitelist support in X.509."

I don't mean to be harsh or difficult here, but your
proposal is far reaching with profound effects on
X.509/PKI communities and implementations.  This 
material also appears to be your own personal 
proposal with no other apparent support.  You 
should be proceeding to get reactions and support
from others on your ideas before attributing them
to a Member State or using your position as Q11/17
rapporteur to advance them.

--tony

On 2014-07-18 5:31 AM, Erik Andersen wrote:

There is some pressure by the major electricity company
(http://energinet.dk/EN/Sider/default.aspx)  to make me the Danish Member
representative in ITU-T SG17. It takes a lot of red tape. I am also active
in IEC TC57 WG15. As I mentioned, the proposal has been submitted to that
group for comments.