PKIX%20Interoperability%20Workshops

1
PKIX Interoperability Workshops

• Mark C. Davis
• davismc_at_us.ibm.com

2
PKIX

• IETF Standard
• Built on X.509 and previous work
• Profile
• Protocols

3
PKIX Profile

• RFC 2459
• PKI Architecture
• What is in a certificate
• How do you verify it
• How do you revoke it

EE
D i r e c t o r y
RA
CA
CA
4
PKIX Protocols

• Request
• CMP Certificate Management Protocol
• CMC Certificate Management using CMS
• Operational
• LDAP
• HTTP, FTP
• Verification
• OCSP
• Algorithm
• ECC

5
Reference Implementations

• IBM/Lotus Jonah implementation
• http//www.mit.edu/pfl
• NIST MISPC
• Minimum Interoperability Specifications for PKI
  Components
• http//csrc.nist.gov/pki/mispc/refimp/referenc.htm

6
Interoperability Workshops

• This is harder than it looks
• Vendor safe atmosphere
• Rules or Gentlemens agreements
• Press and Marketing not invited
• Technical focus
• Determining test cases first major work
• Developers fix code on the spot
• Communications
• Correct Participants

7
Workshop Logistics

• Face to face communications
• Conference room or Hotel meeting room
• Local Network

LDAP Server
Test Machines
Internet
Network Server
8
Virtual Workshop Logistics

• Chat server supplemented mailing list
• LDAP Server on Internet
• Traffic on Internet

Test Machines
LDAP Server
Internet
Chat (Irc) Server
9
What we found

• Different implementation strategies
• Each group had different priorities
• Prep work included agreement on common features
• Ambiguities in specification
• Input to revisions to RFC2459
• Revised CMP underway
• Improvements to the protocol
• CMP improvements
• Virtual Workshops actually work
• Based on earlier face to face progress

10
Questions