Internet Info 1997 December/Internet_Info_CD-ROM_Walnut_Creek_December_1997.iso/ietf/pem/pem-minutes-94mar.txt

Text File | 1994-06-04 | 7KB | 177 lines

CURRENT_MEETING_REPORT_

Reported by Steve Kent/BBN

Minutes of the Privacy Enhanced Mail Working Group (PEM)

A show of hands indicated that about 70-75% of the attendees were new
(i.e., have not previously attended a PEM Working Group meeting).  A
number of 822EXT Working Group members attended, probably because of the
first agenda topic.


MIME/PEM Integration

The primary agenda topic for this meeting was a review of the latest
MIME/PEM Internet-Draft, published about two weeks prior to this
meeting.  Steve Crocker lead the discussion of this new draft,
explaining the major features of this proposal, in particular, noting
differences between this proposal and the features provided by the PEM
format defined by RFC 1421.

These features include:


   o Optional use of separate keys for encryption and signature;

   o Protection of any content type, through recursive use of the MIME
     multipart construct;

   o Use of MIME transfer encoding (e.g., ``quoted-printable'') to
     eliminate the need for the MIC-CLEAR processing type;

   o Encryption and signature control information separate from the
     message body;

   o Encryption and signature control information placed at the end of
     the message;

   o CRLs, certificates, etc., all supported in a message via separate
     body parts, removing the need for separate message types for
     management functions (e.g, CRL distribution and requests, etc.);
     and

   o Optional inclusion of message header information within protected
     boundary (e.g., if message/RFC822 is the encapsulated body part
     type).


Some of these features precipitated some discussion.  For example, it
was noted that placing encryption (versus signature) control information
at the end of the message precludes one-pass message processing.  The
primary motivation for placing encryption and signature control
information at the end of the message is to reduce visual clutter,
especially for non-PEM recipients.  However, this rationale does not
apply to encrypted messages (which, by definition, are not directed to
non-PEM users), so there appears to be much less motivation to place
encryption data at the end of a message.  The discussion suggested that
review of this aspect of the design is in order.

The only significant problem uncovered during the review relates to
forwarding of signed messages, especially ones that contain other than
just text.  The problem here is that the proposal relies on use of MIME
context transfer encoding (CTE) to produce a canonical representation
for content.  Canonicalization is critical for the transmission of
signed data, to ensure that a recipient can verify the signature.
However, the CTE is only pair-wise between an originator and the
``original'' set of recipients for a message.  If one of these
recipients forwards a signed message to a third party, a different CTE
may be employed, resulting in a different representation for the
content, and a consequent failure of the signature on the forwarded
message.  This discussion suggested that the proposal be modified so
that an originator can specify a fixed, canonical encoding for a
content, enabling forwarding of signed messages that preserves the
original encoding.

The authors of this MIME/PEM proposal agreed to go back and work on this
last problem, producing a new proposal that addresses this rather
critical problem.

One last issue was briefly discussed under this agenda topic, but a
decision was deferred.  The issue is whether a MIME/PEM RFC should
supersede RFC 1421, or whether we should have parallel MIME and
``vanilla'' RFC 822 versions of PEM. There was some sentiment expressed
for maintaining these as parallel RFCs, but the decision has been
deferred pending availability of a MIME/PEM RFC.



Changes in Working Group Organization


In consultation with the outgoing and incoming Security Area Directors,
it has been decided to reorganize the PEM Working Group, as described
below.

The PEM Working Group will soon be redefined to encompass a limited
scope, namely the syntax and top-level processing of PEM messages.  One
or more new working groups will soon be created to address the topic of
certification management.  One of these working groups will address
design of a certification system that is not hierarchical (in contrast
to the one defined in RFC 1422), and a second working group may be
created to continue to refine the sort of hierarchical certification
system currently described in RFC 1422.



Discussion of Certification System Parameters

The remainder of the working group session was devoted to a brief review
of various characteristics of certification systems that have been the
focus of recent debate on the mailing list (e.g., the form of names in
certificates, self-signed certificates, etc.).  Since this discussion
was just a brief, top-level review of the more detailed discussions that
have taken place on the mailing list, no detailed minutes are provided
on this portion of the meeting.


Attendees

Perkins Bass             [e-mail]
John Beck                [e-mail]
Kym Blair                [e-mail]
Steven Blair             [e-mail]
Larry Blunk              [e-mail]
David Carrel             [e-mail]
Rong Chang               [e-mail]
Wallace Colyer           [e-mail]
Jim Conklin              [e-mail]
Naomi Courter            [e-mail]
Shane Davis              [e-mail]
Peter DiCamillo          [e-mail]
Cheri Dowell             [e-mail]
Donald Eastlake          [e-mail]
Erik Fair                [e-mail]
Antonio Fernandez        [e-mail]
Lois Frampton            [e-mail]
Barbara Fraser           [e-mail]
Jerome Freedman          [e-mail]
James Galvin             [e-mail]
Chris Gorsuch            [e-mail]
Richard Graveman         [e-mail]
Terry Gray               [e-mail]
Dragan Grebovich         [e-mail]
Richard Harris           [e-mail]
Marco Hernandez          [e-mail]
Marc Horowitz            [e-mail]
Ryu Inada                [e-mail]
Robert Karsten           [e-mail]
Charlie Kaufman          [e-mail]
Stephen Kent             [e-mail]
Paul Lambert             [e-mail]
Lars-Johan Liman         [e-mail]
John Linn                [e-mail]
Piers McMahon            [e-mail]
Michael Michnikov        [e-mail]
Paul Mockapetris         [e-mail]
Kim Morla                [e-mail]
Sandra Murphy            [e-mail]
John Myers               [e-mail]
Chris Newman             [e-mail]
Radia Perlman            [e-mail]
Michael Ressler          [e-mail]
Corey Satten             [e-mail]
Chris Seabrook           [e-mail]
Michael St.  Johns       [e-mail]
Einar Stefferud          [e-mail]
Don Stephenson           [e-mail]
Jeff Thompson            [e-mail]
Theodore Ts'o            [e-mail]
Gregory Vaudreuil        [e-mail]
Dale Walters             [e-mail]
John Wray                [e-mail]
Suguru Yamaguchi         [e-mail]
Shinichi Yoshida         [e-mail]